catalog

1. 漏洞描述
2. 漏洞觸發(fā)條件
3. 漏洞影響范圍
4. 漏洞代碼分析
5. 防御方法
6. 攻防思考

?

1. 漏洞描述

ECShop存在一個(gè)盲注漏洞，問題存在于/api/client/api.php文件中，提交特制的惡意POST請(qǐng)求可進(jìn)行SQL注入攻擊，可獲得敏感信息或操作數(shù)據(jù)庫

http://sebug.net/vuldb/ssvid-21007

2. 漏洞觸發(fā)條件

1. /api/client/api.php存在未過濾漏洞
2. 服務(wù)器magic_quote_gpc = off 
//magic_quote_gpc特性已自 PHP 5.3.0 起廢棄并將自 PHP 5.4.0 起移除，即默認(rèn)情況下，magic_quote_gpc = Off

0x1: POC

http://localhost/ecshop2.7.2/api/client/api.php?Action=UserLogin
POST: UserId=%27%20or%20user_id=1%23

Relevant Link:

http://php.net/manual/zh/info.configuration.php

3. 漏洞影響范圍
4. 漏洞代碼分析

/api/client/api.php

<?phpdefine('IN_ECS', true);include_once './includes/init.php';//分發(fā)處理POST數(shù)據(jù)
dispatch($_POST);
?>

/api/client/includes/lib_api.php

function dispatch($post)
{// 分發(fā)器數(shù)組$func_arr = array('GetDomain', 'UserLogin', 'AddCategory', 'AddBrand', 'AddGoods', 'GetCategory', 'GetBrand', 'GetGoods', 'DeleteBrand', 'DeleteCategory', 'DeleteGoods', 'EditBrand', 'EditCategory', 'EditGoods');//當(dāng)$_POST['Action'] == 'UserLogin'的時(shí)候調(diào)用API_UserLoginif(in_array($post['Action'], $func_arr) && function_exists('API_'.$post['Action'])){return call_user_func('API_'.$post['Action'], $post);}else{API_Error();}
}

/api/client/includes/lib_api.php

function API_UserLogin($post)
{$post['username'] = isset($post['UserId']) ? trim($post['UserId']) : '';$post['password'] = isset($post['Password']) ? strtolower(trim($post['Password'])) : '';/* 檢查密碼是否正確 *///$post['username']未進(jìn)行過濾，造成盲注漏洞，參數(shù)是直接從原始$_POST獲取的，未進(jìn)行任何預(yù)處理，不受內(nèi)核過濾影響$sql = "SELECT user_id, user_name, password, action_list, last_login"." FROM " . $GLOBALS['ecs']->table('admin_user') ." WHERE user_name = '" . $post['username']. "'";$row = $GLOBALS['db']->getRow($sql);..

Relevant Link:

http://www.wooyun.org/bugs/wooyun-2010-02969

5. 防御方法

/api/client/includes/lib_api.php

function API_UserLogin($post)
{/* SQL注入過濾 */if (get_magic_quotes_gpc()) {     $post['UserId'] = $post['UserId']     } else {     $post['UserId'] = addslashes($post['UserId']);     }/* */$post['username'] = isset($post['UserId']) ? trim($post['UserId']) : '';..

Relevant Link:

http://www.topit.cn/ecshop-tutorial/ecshop_mangzhu_bug_for_ecshop_v2.7.2-195.html

6. 攻防思考

Copyright (c) 2015 LittleHann All rights reserved

?

轉(zhuǎn)載于:https://www.cnblogs.com/LittleHann/p/4523963.html

總結(jié)

以上是生活随笔為你收集整理的ecshop /api/client/api.php、/api/client/includes/lib_api.php SQL Injection Vul的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。