dedecms/member/edit_baseinfo.php SQL Injection Vul

Catalog

1 . Vulnerability Description 2 . Vulnerability trigger Condition 3 . Vulnerability Impact Range 4 . Vulnerability Code Analysis 5 . Defense Methods 6. Defensive thinking

1. Vulnerability description

SQL injection present in the membership module

Relevant Link:

http://www.grabsun.com/article/2015/1216455.html

2. Vulnerability Trigger Condition

 1  . Register the user and log in  2 . Open Http:// 127.0.0.1/dedecms5.5/member/edit_baseinfo.php  3   4 . Then change the value of newsafequestion in burp to: 1  Span style= "color: #800000;" > '    '  ', Uname= (select  User ()), Email= sss  5 . Then open Http:// 127.0.0.1/dedecms5.5/member /edit_baseinfo.php  6 . You can see that your username becomes the result of the injection 

Relevant Link:

http://www.wooyun.org/bugs/wooyun-2014-048873

3. Vulnerability Impact Range
4. Vulnerability Code Analysis

/member/edit_baseinfo.php

.. //Modify security Issuesif($newsafequestion! =0&& $newsafeanswer! ="'){    if(strlen ($newsafeanswer) > -) {showmsg ('The answer to your new security question is too long, please keep it within 30 bytes! ','-1');    Exit (); }    Else    {        //the newsafequest here are not filtered, and hackers can inject SQL code into $addupquery for subsequent SQL queries$addupquery. =", safequestion= ' $newsafequestion ', safeanswer= ' $newsafeanswer '"; }}..//bring into SQL query$query 1 ="Update ' #@__member ' Set pwd= ' $pwd ', sex= ' $sex ' {$addupquery} where mid= '". $cfg _ml->m_id."'"; $dsql->executenonequery ($query 1);

5. Defense Methods

/member/edit_baseinfo.php

..//Modify security Issuesif($newsafequestion! =0&& $newsafeanswer! ="'){    if(strlen ($newsafeanswer) > -) {showmsg ('The answer to your new security question is too long, please keep it within 30 bytes! ','-1');    Exit (); }    Else    {    /*Filter*/$newsafequestion= Htmlreplace ($newsafequestion,1); $newsafeanswer= Htmlreplace ($newsafeanswer,1); /* */$addupquery.=", safequestion= ' $newsafequestion ', safeanswer= ' $newsafeanswer '"; }}.. $query 1="UPDATE ' #@__member ' SET pwd= ' $pwd ', sex= ' $sex ' {$addupquery} where mid= '". $cfg _ml->m_id."'"; $dsql->executenonequery ($query 1);

6. Defensive Thinking

Copyright (c) Littlehann All rights reserved

dedecms/member/edit_baseinfo.php SQL Injection Vul