Release date: 2011.1.5
Mining Author: fjhgx (rural)
Contact: bugtosafe@gmail.com
Vulnerability file: lib_payment.php
Vulnerability function: get_order_id_by_sn ($ order_sn, $ voucher = false)
Includeslib_payment.php (ECSHOP payment interface function library ): (53 rows)
/**
* Obtain the order ID through the order sn
* @ Param string $ order_sn order sn
* @ Param blob $ voucher whether to recharge a member
*/
Function get_order_id_by_sn ($ order_sn, $ voucher = false)
{
If ($ voucher = true) // to trigger a vulnerability, ensure that the second parameter of the function is true.
{
Return $ GLOBALS [db]-> getOne ("SELECT log_id FROM ". $ GLOBALS [ecs]-> table (pay_log ). "WHERE order_id = ". $ order_sn. AND order_type = 1 );
// The vulnerability is located in the $ order_sn variable. The cause of the vulnerability is not filtered by single quotes. From: fjhgx (rural)
}
Else
{
If (is_numeric ($ order_sn ))
{
$ SQL = SELECT order_id FROM. $ GLOBALS [ecs]-> table (order_info). "WHERE order_sn = $ order_sn ";
$ Order_id = $ GLOBALS [db]-> getOne ($ SQL );
}
If (! Empty ($ order_id ))
{
$ Pay_log_id = $ GLOBALS [db]-> getOne ("SELECT log_id FROM ". $ GLOBALS [ecs]-> table (pay_log ). "WHERE order_id = ". $ order_id. "");
Return $ pay_log_id;
}
Else
{
Return "";
}
}
} |
Respond. php (ECSHOP payment response page ): (56 rows)
/* Determine whether to enable * // determine the payment method. From: fjhgx (rural)
$ SQL = "SELECT COUNT (*) FROM". $ ecs-> table (payment). "WHERE pay_code = $ pay_code AND enabled = 1 ";
If ($ db-> getOne ($ SQL) = 0)
{
$ Msg = $ _ LANG [pay_disabled];
}
Else
{
$ Plugin_file = des/modules/payment/. $ pay_code.. php; // the file containing the payment method, which is located in the "includesmodulespayment" directory. /* Check whether the plug-in file exists. If yes, verify that the payment is successful. Otherwise, the error message is returned */
If (file_exists ($ plugin_file ))
{
/* Create a payment Class Object Based on the payment method code and call its response operation method */
Include_once ($ plugin_file ); $ Payment = new $ pay_code ();
$ Msg = ($ payment-> respond ())? $ _ LANG [pay_success]: $ _ LANG [pay_fail];
}
Else
{
$ Msg = $ _ LANG [pay_not_exist];
}
} |
There are a total of three vulnerabilities that may be triggered:
1: Tenpay. php (200 rows)
If ($ attach = voucher)
{
$ Log_id = get_order_id_by_sn ($ sp_billno, "true"); // call the function in the vulnerability, get_order_id_by_sn. From: fjhgx (rural)
}
Else
{
$ Log_id = get_order_id_by_sn ($ sp_billno );
} |
2: Cncard. php (207 rows)
// After the verification is passed, the Order sn is converted to the ID to operate the ec order table
If ($ c_memo2 = voucher)
{
$ C_order = get_order_id_by_sn ($ c_order, "true"); // note from: I am a rural bugtosafe@gmail.com
}
Else
{
$ C_order = get_order_id_by_sn ($ c_order );
} |
3: Chinabank. php (156 rows)
// After the verification is passed, the Order sn is converted to the ID to operate the ec order table
$ V_oid = get_order_id_by_sn ($ v_oid, "true"); // note from: |
