Walks

网络安全爱好者

代码审计:Semcms v2.3 PHP版多处问题

前言:

《代码审计:Semcms v2.3 PHP版多处问题》

如上图,在知道创宇看到了几个新出的漏洞,就想去看看漏洞出在什么地方,下载最新V2.3版本,发现了一个很有趣的问题,原来这个漏洞是V2.1版本就有的,至今未修复。下面就给大家简单的分析分析,其实漏洞也很简单。

Web_Mail注入:

if ($Type=="fintpassword"){
    
    
  if (@htmlspecialchars($_POST['Email']) !==""){ // 判断是否输入邮箱
        
    $sql="select * from sc_user where user_email='".$_POST['Email']."'"; 
    $result=mysql_query($sql); 
    $row = mysql_fetch_array($result,MYSQL_ASSOC); 
    if (mysql_num_rows($result)>0) 
        {

我们看代码,你是不是发现了问题?虽然if语句里面有htmlspecialchars这个用来过滤单双引号,但是后面sql执行的时候,过滤的东西跑哪去啦?这就产生了注入。

后台绕过:

function checkuser(){ //判断账号 
    $cookieuser=@htmlspecialchars($_COOKIE["scuser"]);
    $cookieuserqx=@htmlspecialchars($_COOKIE["scuserqx"]);
    $sql="select * from sc_user where user_ps='$cookieuser' and user_qx='$cookieuserqx'"; 
    $result=mysql_query($sql); 
    $row = mysql_fetch_array($result,MYSQL_ASSOC); 
    if (!mysql_num_rows($result)){ echo "<script language='javascript'>alert('账号密码不正确重新登陆!');top.location.href='index.html';</script>";} 
    else {echo'';}     
  
}

这是在function.php里面的代码,虽然有简单的过滤,但是依旧可以绕过。

当$cookieuser=\;$cookieuserqx=or 1=1# 的时候,sql语句等于select * from sc_user where user_ps='\' and user_qx='or 1=1#',后面的单引号跟前面的闭合了。产生了我们可控的参数。就可以后台登陆了。

还有其他几个漏洞不多说。给大家个V2.1版本漏洞的地址,反正跟V2.3的一样,也没修复,想看的自己看看吧。

参考地址:http://0day5.com/archives/4320/

点赞
  1. kobe 11说道:

    I precisely desired to thank you very much all over again. I do not know the things I would have done in the absence of the entire thoughts shown by you directly on such a field. It became a frustrating case in my circumstances, but looking at the very skilled style you dealt with it made me to jump for gladness. I'm just happy for your help and as well , trust you really know what a powerful job you have been carrying out teaching most people through a site. I am certain you haven't encountered all of us.

  2. I must show appreciation to this writer for rescuing me from this condition. As a result of looking throughout the the web and finding thoughts that were not productive, I thought my entire life was done. Existing devoid of the strategies to the issues you have resolved all through your good write-up is a critical case, and ones which could have adversely damaged my entire career if I hadn't noticed your web blog. The capability and kindness in taking care of all the details was very useful. I don't know what I would have done if I had not come upon such a step like this. I am able to now relish my future. Thank you so much for this skilled and sensible guide. I won't be reluctant to propose your blog to any person who wants and needs counselling about this issue.

  3. VovaMooro说道:

    tem is ato

    2659 enter site approved is fda

  4. VovaMooro说道:

    is online at eu

    2659 is farmacia prezzo

  5. yeezy shoes说道:

    I must express some thanks to this writer just for bailing me out of this crisis. Right after exploring throughout the online world and seeing notions which are not beneficial, I assumed my entire life was gone. Being alive devoid of the solutions to the difficulties you've resolved all through your good short article is a serious case, and the ones which may have adversely affected my entire career if I had not noticed your website. Your main natural talent and kindness in taking care of a lot of stuff was priceless. I'm not sure what I would've done if I hadn't encountered such a point like this. I am able to at this time look ahead to my future. Thanks for your time very much for this high quality and results-oriented help. I won't be reluctant to propose the website to anybody who should have guide about this topic.

  6. VovaMooro说道:

    is professional from usa

    2659 is 10 mg lilly prei

  7. FursMooro说道:

    torontoatis

    aacd is sildenafil

  8. yeezy boost 350说道:

    I in addition to my guys happened to be examining the great points found on your web blog then immediately came up with a horrible suspicion I had not thanked the website owner for those tips. All the boys had been for this reason thrilled to read them and have in effect actually been using them. I appreciate you for indeed being well accommodating and also for opting for this kind of magnificent topics most people are really desirous to be aware of. My personal honest regret for not expressing gratitude to sooner.

  9. FursMooro说道:

    at name for is funny

    aacd levitra is preisvergleich

  10. SvobodaMooro说道:

    look here is iop

    9042 is venta en miami

  11. SvobodaMooro说道:

    at is be no

    9042 female is india

  12. yeezy boost说道:

    I want to express appreciation to the writer just for bailing me out of such a matter. Because of exploring through the the web and meeting tips that were not helpful, I was thinking my life was over. Existing without the strategies to the difficulties you have resolved as a result of the blog post is a crucial case, as well as the ones that might have in a negative way affected my career if I had not discovered your blog post. Your main capability and kindness in dealing with all the details was priceless. I don't know what I would have done if I had not encountered such a stuff like this. I can also now look ahead to my future. Thanks so much for the professional and result oriented help. I will not be reluctant to refer your web sites to any individual who requires assistance about this problem.

  13. SvobodaMooro说道:

    female is india

    9042 is 4cpr riv 20 mg

  14. SvobodaMooro说道:

    be is delived fed ex

    9042 cheap at is in canada

  15. cheap jordans说道:

    Thanks for all of the labor on this blog. My niece takes pleasure in participating in internet research and it is simple to grasp why. We know all relating to the powerful tactic you offer precious suggestions via the web site and as well foster participation from other people on this idea while our favorite child is without a doubt starting to learn a lot. Take advantage of the rest of the new year. You are performing a glorious job.

  16. RebekkaMooro说道:

    ato do is dosagem

    88fc vardenafil is

  17. RebekkaMooro说道:

    canada is prices

    88fc be walmart is

  18. nike huarache说道:

    I really wanted to construct a small message to be able to say thanks to you for all the magnificent advice you are sharing on this site. My long internet search has at the end of the day been recognized with high-quality ideas to talk about with my close friends. I would point out that we visitors actually are really fortunate to be in a useful place with so many lovely individuals with very helpful methods. I feel extremely grateful to have discovered the webpages and look forward to tons of more entertaining moments reading here. Thank you once more for a lot of things.

  19. RebekkaMooro说道:

    cvs is 50mg cost

    88fc at is dapoxetine nz

  20. KallinikaMooro说道:

    best price 60 mg is

    441d is coupon free trial

  21. KallinikaMooro说道:

    look there is en gel

    441d generika is rezeptfrei

  22. pandora bracelet说道:

    I needed to write you the little bit of remark to finally give many thanks again considering the fantastic methods you've shared here. This has been so shockingly open-handed of people like you giving freely all that many people would've advertised for an ebook to generate some bucks for their own end, chiefly seeing that you might well have done it in case you considered necessary. These smart ideas in addition worked like the fantastic way to comprehend many people have the same keenness just like my own to learn whole lot more regarding this problem. I think there are thousands of more pleasurable moments ahead for those who looked over your website.

  23. KallinikaMooro说道:

    canada is online no

    441d comprar is en australia

  24. KallinikaMooro说道:

    my rx is

    441d effet indesirable is 20mg

  25. KristianaMooro说道:

    price of is 2013 aetna

    b5db next day cheap uk is

  26. KristianaMooro说道:

    achat is livraison rapide

    b5db at order is

  27. A lot of thanks for your own hard work on this web page. Kate takes pleasure in participating in research and it is easy to understand why. Most people learn all concerning the dynamic mode you give functional secrets on your blog and therefore foster contribution from the others on that area and my girl is truly starting to learn so much. Take advantage of the remaining portion of the new year. You are conducting a dazzling job.

  28. KristianaMooro说道:

    tabs soft is

    b5db is over the counter cost

  29. KristianaMooro说道:

    is farmacia barcelon

    b5db be 1 is gold pill

  30. KristianaMooro说道:

    pictures of is pills

    b5db is infused condoms

  31. KristianaMooro说道:

    is sur nice

    b5db is us cheap

  32. KristianaMooro说道:

    is tips

    b5db the best site be is

  33. Thank you so much for giving everyone remarkably spectacular opportunity to read from this web site. It is usually very good plus full of a great time for me and my office co-workers to visit your site no less than three times every week to read through the new things you will have. And definitely, I am also at all times happy with the fabulous things served by you. Certain 1 tips in this article are in fact the most suitable I have ever had.

  34. GordianMooro说道:

    muestra de is genrico

    be07 wo kann ich is kaufen

  35. GordianMooro说道:

    comprare is ato onlin

    be07 be is online in eu

  36. GordianMooro说道:

    only here canadian rx is

    be07 le mieux is en inde

  37. GordianMooro说道:

    how to get is cheaper

    be07 wow overseas is

  38. GordianMooro说道:

    only today 100 mg is

    be07 can you be is uk

  39. GordianMooro说道:

    be is online in eu

    be07 is 5 mg sin receta

  40. nmd uk说道:

    I have to voice my affection for your kind-heartedness for men who have the need for help with this important idea. Your real dedication to passing the solution across came to be surprisingly productive and have specifically encouraged others just like me to attain their dreams. Your amazing valuable information indicates this much a person like me and much more to my colleagues. Thanks a lot; from all of us.

  41. ErmilMooro说道:

    il is e prescrivibile

    aa72 forum is vs vs is

  42. I and also my guys were actually looking through the excellent tips and hints on the website and all of a sudden I got a horrible feeling I never thanked the web site owner for those techniques. All the people became very interested to study them and have undoubtedly been having fun with them. Thanks for really being indeed accommodating as well as for making a choice on this form of fantastic information millions of individuals are really wanting to discover. My personal sincere regret for not expressing appreciation to sooner.

  43. ErmilMooro说道:

    is son prix

    aa72 tabletten is billig

  44. ErmilMooro说道:

    prix is 50 mg en pharmacie

    aa72 is anoniem

  45. ErmilMooro说道:

    is need a prescription aus

    aa72 is achat online

  46. ErmilMooro说道:

    a is without prescription

    aa72 mail order at is

  47. ErmilMooro说道:

    costco is pricing

    aa72 is lawsuit canada

  48. ErmilMooro说道:

    is rezeptfrei kaufen usa

    aa72 wirkung von is 100

  49. I wanted to create you a tiny word to be able to give thanks once again just for the stunning solutions you've provided on this page. This is so unbelievably generous with you to give extensively exactly what many people could possibly have offered as an electronic book to get some dough on their own, chiefly considering the fact that you might well have done it in the event you wanted. The tricks also served to be the easy way to comprehend most people have similar eagerness similar to mine to learn a little more when it comes to this matter. I'm sure there are several more pleasurable occasions ahead for individuals who take a look at your blog post.

  50. My spouse and i have been now happy when Peter could carry out his inquiry using the precious recommendations he grabbed through the site. It is now and again perplexing just to be giving out things that the others may have been selling. And we all recognize we've got the writer to give thanks to for that. The most important illustrations you have made, the easy website navigation, the relationships your site help promote - it's everything awesome, and it's leading our son and us feel that that matter is amusing, and that is especially important. Thanks for all!

  51. tory burch说道:

    I'm also writing to make you understand what a outstanding discovery our child experienced viewing your web site. She came to understand numerous pieces, which include what it's like to possess an incredible coaching spirit to let most people without problems completely grasp a variety of very confusing subject matter. You really surpassed our expectations. I appreciate you for showing such beneficial, healthy, revealing and in addition fun guidance on your topic to Jane.

  52. nike outlet说道:

    I must express thanks to the writer just for rescuing me from such a instance. After browsing through the search engines and getting views which were not helpful, I was thinking my entire life was done. Living devoid of the approaches to the issues you have solved all through your main review is a crucial case, as well as the kind which may have badly affected my entire career if I hadn't come across your web site. Your primary expertise and kindness in handling all the things was priceless. I'm not sure what I would've done if I hadn't encountered such a subject like this. I can also at this point look ahead to my future. Thank you so much for the reliable and effective guide. I won't be reluctant to recommend your web page to any individual who ought to have direction about this topic.

  53. KlementinaMooro说道:

    is professional online

    d5cb be liquid is view

  54. cheap jordans说道:

    I needed to write you a little bit of note so as to thank you once again for the awesome guidelines you have contributed above. This has been simply remarkably open-handed of you to make unreservedly precisely what a lot of folks could possibly have marketed as an ebook to get some profit for their own end, even more so since you could possibly have tried it if you ever considered necessary. These secrets also served like a great way to fully grasp that many people have the same fervor really like my own to see whole lot more when it comes to this issue. I am sure there are several more enjoyable times up front for those who look over your blog post.

  55. KlementinaMooro说道:

    siti sicuri is ato

    d5cb is tablets spain

  56. KlementinaMooro说道:

    is ato 20mg opiniones

    d5cb is soft usa cvs prices

  57. golden goose说道:

    I am glad for writing to let you be aware of what a extraordinary encounter my friend's child went through visiting your site. She discovered a wide variety of issues, with the inclusion of what it's like to possess an amazing teaching mindset to have other people easily fully understand several grueling matters. You truly surpassed her desires. Many thanks for supplying these valuable, safe, revealing as well as easy tips about your topic to Mary.

  58. KlementinaMooro说道:

    is at blog

    d5cb venta is soft cubano

  59. hermes belt说道:

    Thank you for all your labor on this blog. Ellie take interest in managing investigation and it's easy to understand why. A number of us notice all about the powerful ways you offer valuable things by means of your blog and therefore inspire response from visitors on this matter and our princess has always been discovering a great deal. Have fun with the remaining portion of the year. You are always carrying out a useful job.

  60. is vente lign

    b950 is is vergleich

  61. nmd说道:

    I needed to send you one little bit of word to help give many thanks again for your extraordinary secrets you've provided here. It has been quite extremely open-handed with you to make without restraint all that a lot of people could have made available as an ebook in order to make some money for their own end, mostly considering the fact that you could have tried it if you wanted. These principles in addition worked as the easy way to know that someone else have a similar interest just as my personal own to grasp many more in terms of this condition. I'm certain there are several more pleasant occasions in the future for people who look over your blog post.

  62. is aux encheres

    b950 is et cardiaque

  63. I want to show some appreciation to this writer just for rescuing me from this particular scenario. After surfing around through the world wide web and getting ways which were not helpful, I assumed my entire life was done. Living devoid of the solutions to the problems you have sorted out all through your main write-up is a serious case, as well as ones which could have negatively affected my entire career if I had not encountered the blog. That natural talent and kindness in maneuvering a lot of things was tremendous. I'm not sure what I would have done if I had not come across such a stuff like this. I can at this point look ahead to my future. Thanks very much for this reliable and effective help. I won't hesitate to recommend your blog post to anyone who ought to have guide about this issue.

  64. is kaufen rezeptpflichtig

    b950 is online dublin

  65. is is vergleich

    b950 is online gekauft

  66. nike cortez说道:

    I am commenting to make you be aware of what a amazing encounter my daughter experienced going through your web site. She came to understand a wide variety of issues, which include what it is like to have an awesome helping nature to make the mediocre ones really easily learn various hard to do subject matter. You undoubtedly exceeded readers' expectations. Thanks for providing those essential, dependable, informative as well as unique tips on the topic to Mary.

  67. is italia milan

    b950 venta is online argentina

  68. is women take what happens

    b950 is and similar drugs

  69. Needed to compose you the very small observation to thank you very much over again for the remarkable tactics you have contributed at this time. It was generous of people like you giving freely just what many individuals would have marketed for an e-book in making some cash for themselves, especially given that you might have done it in case you desired. These solutions additionally acted as a easy way to be sure that some people have the same passion like my own to learn a great deal more with respect to this issue. I'm sure there are a lot more pleasurable sessions ahead for many who browse through your website.

发表评论

电子邮件地址不会被公开。 必填项已用*标注