PHPDISK 4.0 SQL injection 0day & amp; Analysis

By t00ls

Text/My5t3ry

Just bored with a set of PHPDISK read the code and found multiple SQL Injection Vulnerabilities. Let's take a look at the following:

We can see line/shortdes/commons. inc. php 68-72, with the following code:

1. If (@ get_magic_quotes_gpc ()){

2. $ _ GET = stripslashes_array ($ _ GET );

3. $ _ POST = stripslashes_array ($ _ POST );

4. $ _ COOKIE = stripslashes_array ($ _ COOKIE );

5. }

Copy code

The GPC is determined. If gpc = on, the stripslashes_array function is called. Then we can see the stripslashes_array function.

1. Function stripslashes_array (& $ array ){

2. If (is_array ($ array )){

3. Foreach ($ array as $ k => $ v ){

4. $ Array [$ k] = stripslashes_array ($ v );

5. }

6. } Elseif (is_string ($ array )){

7. $ Array = stripslashes ($ array );

8. }

9. Return $ array;

10. }

Copy code

If gpc = on, this function restores the escaped characters! In other words, you can ignore gpc and continue to see/extract. php 24-50 lines of code:

1. Switch ($ actIon ){

2. Case file_extract:

4. If ($ p_formhash! = Formhash ()){

5. Exit ($ lang [system_error]);

6. }

7. $ Extract_coDe = trim (gpc (extract_coDe, P,); // look

9. $ Rs2 = $ db-> fetch_onE_array ("select * from {$ tpf} extracts where extract_coDe = $ extract_coDe "); // $ extract_coBringing de into SQL query

10. If ($ rs2 ){

11. If ($ rs2 [extract_locked]) {

12. $ Error = true;

13. $ Sysmsg [] = $ lang [extract_coDe_locked];

14. } Else {

15. $ Db-> query ("update {$ tpf} extracts set extract_count = extract_count + 1 where extract_id =". $ rs2 [extract_id]. "");

16. If ($ rs2 [extract_type] = 1 ){

17. If ($ timestamp> $ rs2 [extract_time]) {

18. $ Error = true;

19. $ Sysmsg [] = $ lang [extract_exceed_time_limit];

20. }

21. } Else {

22. If ($ rs2 [extract_total] & ($ rs2 [extract_count]> $ rs2 [extract_total]) {

23. $ Error = true;

24. $ Sysmsg [] = $ lang [extract_exceed_count_limit];

25. }

26. }

27. }

Copy code

The Code $ extract_coDe = trim (gpc (extract_coDe, P,); call the gpc function. Follow up on this function:

1. Function gpc ($ name, $ w = GPC, $ default = ){

2. $ I = 0;

3. For ($ I = 0; $ I <strlen ($ w); $ I ++ ){

4. If ($ w [$ I] ==g & isset ($ _ GET [$ name]) return $ _ GET [$ name];

5. If ($ w [$ I] = P & isset ($ _ POST [$ name]) return $ _ POST [$ name];

6. & Nbs