dedecms/include/helpers/archive.helper.php SQL Injection Vul

Catalog

1 . Vulnerability Description 2 . Vulnerability trigger Condition 3 . Vulnerability Impact Range 4 . Vulnerability Code Analysis 5 . Defense Methods 6. Defensive thinking

1. Vulnerability description

DEDECMS Member Center Injection vulnerability

Relevant Link:

http://www.wooyun.org/bugs/wooyun-2010-048892

2. Vulnerability Trigger Condition

1. Open http://127.0.0.1/dedecms5.7/member/soft_add.php2. Add Software3. Open the Burp grab bag1) Change the picnum to Typeid22) and then the parameter write 5', 1,1,1,@ ''`),('-1','7', User (),'3','1389688643','1389688643','8'),(1,2,'

3. Vulnerability Impact Range
4. Vulnerability Code Analysis

/include/helpers/archive.helper.php

if(! function_exists ('Getindexkey') {function Getindexkey ($arcrank, $typeid, $sortrank=0, $channelid =1, $senddate =0, $mid =1)     {         //$typeid 2 from outside, combined with Dede local variable overwrite vulnerability can modify this variable value        Global$dsql, $senddate, $typeid 2; if(Empty ($typeid 2)) $typeid 2 =0; if(Empty ($senddate)) $senddate =Time (); if(Empty ($sortrank)) $sortrank =$senddate; //$typeid 2, $senddate have not been effectively filtered to bring into SQL query$iquery ="INSERT into ' #@__arctiny ' (' Arcrank ', ' typeid ', ' Typeid2 ', ' channel ', ' senddate ', ' Sortrank ', ' mid ') VALUE S ('$arcrank','$typeid','$typeid 2','$channelid','$senddate','$sortrank','$mid')";Echo $iquery; $dsql-executenonequery ($iquery); $aid= $dsqlGetlastid (); return$aid; } }

/archive.helper.php is an auxiliary function library, which is the source of the vulnerability, and the real vulnerability vector is triggered by the Getindexkey function calling this file.
/member/soft_add.php

 else  if  ($dopost == '  

Relevant Link:

http://www.wooyun.org/bugs/wooyun-2010-048892

5. Defense Methods

/include/helpers/archive.helper.php

if(! function_exists ('Getindexkey') {function Getindexkey ($arcrank, $typeid, $sortrank=0, $channelid =1, $senddate =0, $mid =1)    {        //$typeid 2 from outside, combined with Dede local variable overwrite vulnerability can modify this variable value        Global$dsql, $senddate, $typeid 2; if(Empty ($typeid 2)) $typeid 2 =0; if(Empty ($senddate)) $senddate =Time (); if(Empty ($sortrank)) $sortrank =$senddate; /*Filter*/$typeid 2=intval ($typeid 2); $senddate=intval ($senddate); /* */$iquery="INSERT into ' #@__arctiny ' (' Arcrank ', ' typeid ', ' Typeid2 ', ' channel ', ' senddate ', ' Sortrank ', ' mid ') V Alues ('$arcrank','$typeid','$typeid 2','$channelid','$senddate','$sortrank','$mid')";$dsqlexecutenonequery ($iquery); $aid= $dsqlGetlastid (); return$aid; }}

6. Defensive Thinking

Copyright (c) Littlehann All rights reserved

dedecms/include/helpers/archive.helper.php SQL Injection Vul