ecshop/api/client/api.php,/api/client/includes/lib_api.php SQL injection Vul

Catalog

1 . Vulnerability Description 2 . Vulnerability trigger Condition 3 . Vulnerability Impact Range 4 . Vulnerability Code Analysis 5 . Defense Methods 6. Defensive thinking

1. Vulnerability description

Ecshop there is a blind hole in the/api/client/api.php file that submits a specially crafted malicious POST request for a SQL injection attack to obtain sensitive information or manipulate the database

http://sebug.net/vuldb/ssvid-21007

2. Vulnerability Trigger Condition

1./api/client/api.php There is no filtering vulnerability 2. Server MAGIC_QUOTE_GPC =//MAGIC_QUOTE_GPC feature has been deprecated since PHP 5.3.0 and will be removed from PHP 5.4.0, by default, MAGIC_QUOTE_GPC = Off

0x1:poc

http://localhost/ecshop2.7.2/api/client/api.php? Action=userloginpost:userid=%%20or%20user_id=1

Relevant Link:

http://php.net/manual/zh/info.configuration.php

3. Vulnerability Impact Range
4. Vulnerability Code Analysis

/api/client/api.php

<? phpdefine ('in_ecs'true'./includes/init.php  '; // distributing and processing post data Dispatch ($_post);? >

/api/client/includes/lib_api.php

function Dispatch ($post) {//Dispatcher Array$func _arr = Array ('GetDomain','Userlogin','addcategory','Addbrand','Addgoods','getcategory','Getbrand','Getgoods','Deletebrand','deletecategory','Deletegoods','Editbrand','editcategory','Editgoods'); //call Api_userlogin when $_post[' Action '] = = ' Userlogin '    if(In_array ($post ['Action'], $func _arr) && function_exists ('Api_'. $post ['Action']))    {        returnCall_user_func ('Api_'. $post ['Action'], $post); }    Else{api_error (); }}

/api/client/includes/lib_api.php

function Api_userlogin ($post) {$post ['username'] = Isset ($post ['UserId']) ? Trim ($post ['UserId']) :"'; $post ['Password'] = Isset ($post ['Password']) ? Strtolower (Trim ($post ['Password'])) :"'; /*Check that the password is correct*/    //$post [' username '] is not filtered, resulting in blind holes, parameters are obtained directly from the original $_post, without any preprocessing, not affected by kernel filtering$sql ="SELECT user_id, user_name, password, action_list, Last_login". " from". $GLOBALS ['ECS']->table ('Admin_user') . "WHERE user_name = '". $post ['username']."'"; $row= $GLOBALS ['DB']->GetRow ($sql); ..

Relevant Link:

http://www.wooyun.org/bugs/wooyun-2010-02969

5. Defense Methods

/api/client/includes/lib_api.php

function Api_userlogin ($post) {/*SQL injection Filtering*/    if(GET_MAGIC_QUOTES_GPC ()) {$post ['UserId'] = $post ['UserId']         }     Else{$post ['UserId'] = Addslashes ($post ['UserId']); }    /* */$post ['username'] = Isset ($post ['UserId']) ? Trim ($post ['UserId']) :"'; ..

Relevant Link:

http://www.topit.cn/ecshop-tutorial/ecshop_mangzhu_bug_for_ecshop_v2.7.2-195.html

6. Defensive Thinking

Copyright (c) Littlehann All rights reserved

ecshop/api/client/api.php,/api/client/includes/lib_api.php SQL injection Vul