Metinfo /admin/include/common.inc.php SQL Injection Vul

標籤：

catalog

1. 漏洞描述2. 漏洞觸發條件3. 漏洞影響範圍4. 漏洞程式碼分析5. 防禦方法6. 攻防思考

 

1. 漏洞描述

Metinfo系統是基於PHP+MYSQL的資訊發布系統，該系統存在邏輯缺陷導致條件注入，可修改任意管理員資訊

Relevant Link:

2. 漏洞觸發條件

從save_met_cookie()中可以看出，此處可執行任意sql語句。正好此處為update的met_admin_table表，所以可直接修改任意使用者密碼等任意操作了。
比如修改密碼，只需要利用met_cookie_filter[]=’,admin_pass=密碼 where admin_id=1#即可

3. 漏洞影響範圍

Metinfo <=5.3

4. 漏洞程式碼分析

/admin/include/common.inc.php

..//$met_cookie第一次賦值給$met_cookie_filter變數，相當於初始化$met_cookie_filter=$met_cookie;foreach(array(‘_COOKIE‘, ‘_POST‘, ‘_GET‘) as $_request) {    //通過foreach註冊GPC變數，導致可以重新覆蓋$met_cookie_filter變數    foreach($$_request as $_key => $_value)     {        $_key{0} != ‘_‘ && $$_key = daddslashes($_value,0,0,1);        $_M[‘form‘][$_key]=daddslashes($_value,0,0,1);    }}$met_cookie=array();//又通過$met_cookie=$met_cookie_filter變數賦值，導致$met_cookie變數可控$met_cookie=$met_cookie_filter;..

繼續跟進daddslashes函數的全域過濾，/admin/include/global.func.php

/*POST變數轉換*/function daddslashes($string, $force = 0 ,$sql_injection =0,$url =0){    !defined(‘MAGIC_QUOTES_GPC‘) && define(‘MAGIC_QUOTES_GPC‘, get_magic_quotes_gpc());    if(!MAGIC_QUOTES_GPC || $force)     {        if(is_array($string))         {            foreach($string as $key => $val)             {                $string[$key] = daddslashes($val, $force);            }        }         else         {            $string = addslashes($string);        }    }    if(is_array($string))    {        if($url)        {            //$string=‘‘;            foreach($string as $key => $val)             {                $string[$key] = daddslashes($val, $force);            }        }        else        {            foreach($string as $key => $val)             {                $string[$key] = daddslashes($val, $force);            }        }    }    else    {        //當SQL_DETECT不為1或者sql_injection為1時，進入字元的過濾，此時會轉義單引號為\’        if(SQL_DETECT != 1 || $sql_injection == 1)        {            $string = str_ireplace("\"","/",$string);            $string = str_ireplace("‘","/",$string);            $string = str_ireplace("*","/",$string);            $string = str_ireplace("~","/",$string);            $url = str_ireplace("\"","/",$url);            $url = str_ireplace("‘","/",$url);            $url = str_ireplace("*","/",$url);            $url = str_ireplace("~","/",$url);            $string = str_ireplace("select", "\sel\ect", $string);            $string = str_ireplace("insert", "\ins\ert", $string);            $string = str_ireplace("update", "\up\date", $string);            $string = str_ireplace("delete", "\de\lete", $string);            $string = str_ireplace("union", "\un\ion", $string);            $string = str_ireplace("into", "\in\to", $string);            $string = str_ireplace("load_file", "\load\_\file", $string);            $string = str_ireplace("outfile", "\out\file", $string);            $string = str_ireplace("sleep", "\sle\ep", $string);            $string = str_ireplace("where", "\where", $string);            $string_html=$string;            $string = strip_tags($string);            if($string_html!=$string)            {                $string=‘‘;            }            $string = str_replace("%", "\%", $string);     //           }    }    return $string;}

這裡漏洞的根源在於Metinfo進行了自訂的所謂的轉義處理，但是卻沒有做到轉義的完備性，缺少了對反引號的轉義導致，如果攻擊者同時輸入"單引號"和"反引號"，Metinfo只會對其中的"單引號"進行轉義，導致出現"\\‘"這種結果，用於轉義單引號的反斜線被"吞噬"了，從而導致PAY重新獲得攻擊能力
我們繼續回溯，尋找和$met_cookie變數的調用有關的利用點
/admin/include/global.func.php

function save_met_cookie(){    global $met_cookie,$db,$met_admin_table;    $met_cookie[‘time‘] = time();    //$met_cookie通過json_encode函數處理成$json，直接拼接到$query字串    $json=json_encode($met_cookie);    $username=$met_cookie[metinfo_admin_id]?$met_cookie[metinfo_admin_id]:$met_cookie[metinfo_member_id];    $username=daddslashes($username,0,1);    //傳入查詢    $query="update $met_admin_table set cookie=‘$json‘ where id=‘$username‘";    $user=$db->query($query);}

json_encode函數會將\、\0之類的特殊字元轉義，所以前面轉議後的\’就變成\\’，剛好把\這個字元轉義了，導致成功引入引號。這是注入的關鍵
以上可以看到，只需要在common.inc.php後引用這些函數，$met_cookie變數都會受到影響 

5. 防禦方法

/admin/include/common.inc.php

..$met_cookie_filter=$met_cookie;foreach(array(‘_COOKIE‘, ‘_POST‘, ‘_GET‘) as $_request) {     foreach($$_request as $_key => $_value)     {        $_key{0} != ‘_‘ && $$_key = daddslashes($_value,0,0,1);        $_M[‘form‘][$_key]=daddslashes($_value,0,0,1);    }}$met_cookie=array();/**/$met_cookie=addslashes(stripslashes($met_cookie_filter));/**/..

6. 攻防思考

Copyright (c) 2015 LittleHann All rights reserved

 

Metinfo /admin/include/common.inc.php SQL Injection Vul