Ecmall latest SQL Injection Vulnerability Analysis

Your domain name/index. php tutao
The website creation template of Ecmall is used. If you have used this template, all of them will be killed.
There is a search box injection. The injection point is:
Your domain name/index. php? App = store & act = search & id = 45 & keyword = aaa & min_price = 100 & max_price = 10000
First, get the parameters sent from get and then combine them into a SQL query statement condition:
1. In search. app. php, this code is used to construct the SQL code for querying min and max prices without filtering:

The code is as follows:

Copy code

/** * Obtain the query condition statement  * * @ Param array $ param query parameter (description of the return values of function _ get_query_param) * @ Return string where statement */ Function _ get_goods_conditions ($ param) { /* Query conditions */ $ Conditions = "g. if_show = 1 AND g. closed = 0 AND s. state = 1"; // The store is on AND is not on sale, If (isset ($ param ['keyword']) { $ Conditions. = $ this-> _ get_conditions_by_keyword ($ param ['keyword'], ENABLE_SEARCH_CACHE ); } If (isset ($ param ['Cate _ id']) { $ Conditions. = "AND g. cate_id _ {$ param ['lay']} = '". $ param ['Cate _ id']. "'"; } If (isset ($ param ['brand']) { $ Conditions. = "AND g. brand = '". $ param ['brand']. "'"; } If (isset ($ param ['region _ id']) { $ Conditions. = "AND s. region_id = '". $ param ['region _ id']. "'"; } If (isset ($ param ['price']) { $ Min = $ param ['price'] ['min']; $ Max = $ param ['price'] ['Max ']; $ Min> 0 & $ conditions. = "AND g. price> = '$ min '"; $ Max> 0 & $ conditions. = "AND g. price <= '$ max '"; } Return $ conditions; } 2. The following code is the query execution part, which directly brings the above parameters into the query: /* Price statistics */ If ($ total_count> NUM_PER_PAGE) { $ SQL = "SELECT MIN (g. price) AS min, MAX (g. price) AS max FROM {$ table} WHERE". $ conditions; $ Row = $ goods_mod-> getRow ($ SQL ); $ Min = $ row ['min']; $ Max = min ($ row ['Max'], MAX_STAT_PRICE ); $ Step = max (ceil ($ max-$ min)/PRICE_INTERVAL_NUM), MIN_STAT_STEP ); $ SQL = "SELECT FLOOR (g. price-'$ min')/' $ step') AS I, count (*) AS count FROM {$ table} WHERE ". $ conditions. "group by I order by I "; $ Res = $ goods_mod-> db-> query ($ SQL ); While ($ row = $ goods_mod-> db-> fetchRow ($ res )) { $ Data ['by _ price'] [] = array ( 'Count' => $ row ['count'], 'Min' => $ min + $ row ['I'] * $ step, 'Max' => $ min + ($ row ['I'] + 1) * $ step, ); } } }

Inject with another file

Defect File:/app/coupon. app. php

The code is as follows:

Copy code

Function extend () { $ Coupon_id = isset ($ _ GET ['id'])? Trim ($ _ GET ['id']): ''; If (empty ($ coupon_id ))     { Echo Lang: get ('no _ coupon '); Exit;     } If (! IS_POST)     { Header ("Content-Type: text/html; charset =". CHARSET ); $ This-> assign ('id', $ coupon_id ); $ This-> assign ('send _ model', Lang: get ('send _ Model ')); $ This-> display ("coupon_extend.html ");     } Else     { If (empty ($ _ POST ['User _ name'])         { $ This-> pop_warning ("involid_data "); Exit;         } $ User_name = str_replace (array ("r", "rn"), "n", trim ($ _ POST ['User _ name']); $ User_name = explode ("n", $ user_name ); $ User_mod = & m ('Member '); $ Users = $ user_mod-> find (db_create_in ($ user_name, 'User _ name ')); If (empty ($ users ))         { $ This-> pop_warning ('involid _ data '); Exit;         } If (count ($ users)> 30)         { $ This-> pop_warning ("amount_gt "); Exit;         } Else         { $ Users = $ this-> assign_user ($ coupon_id, $ users ); $ Store = $ this-> _ store_mod-> get_info ($ this-> _ store_id ); $ Coupon = $ this-> _ coupon_mod-> get_info ($ coupon_id ); $ Coupon ['store _ name'] = $ store ['store _ name']; $ Coupon ['store _ id'] = $ this-> _ store_id; $ This-> _ message_to_user ($ users, $ coupon ); $ This-> _ mail_to_user ($ users, $ coupon ); $ This-> pop_warning ("OK", "coupon_extend ");         }     } } First, coupon_id only filters spaces, and then enters the get_info function in the else statement: Function get_info ($ id) { $ Goods = $ this-> get (array ( 'Condition' => "goods_id = '$ ID '", 'Join' => 'belongs _ to_store ', 'Fields' => 'This. *, store. State' )); ... Omitted After reading the code, you will know that the above conditions and so on are all concatenated into SQL statements and will eventually enter the database. Therefore, injection produces POST index. php? App = coupon & act = extend & id = 1 [exp] Data: user_name = test (user name currently logged on)

Note: This article only tells you about any bugs, so that the webmasters can make up for them in time and this article is only for learning and use. All the consequences have nothing to do with this site.