Ucenter Home SQL注入漏洞详细分析(需要GPC=OFF)

最新推荐文章于 2026-02-14 00:33:16 发布

转载最新推荐文章于 2026-02-14 00:33:16 发布 · 2k 阅读

标签

#Ucenter Home

漏洞收集专栏收录该内容

207 篇文章

订阅专栏

本文深入探讨了两个SQL注入漏洞实例，详细分析了漏洞所在文件及代码逻辑，并提出了相应的防护措施。通过案例研究，揭示了GPC参数处理的不当之处可能导致的安全风险。

SQL Injection 1：

漏洞在文件\source\cp_profile.php

<?php //  
.......省略.......

                //性别
                $_POST['sex'] = intval($_POST['sex']);
                if($_POST['sex'] && empty($space['sex'])) $setarr['sex'] = $_POST['sex'];
                
                foreach ($profilefields as $field => $value) {
                        if($value['formtype'] == 'select') $value['maxsize'] = 255;
                        $setarr['field_'.$field] = getstr($_POST['field_'.$field], $value['maxsize'], 1, 1);
                        if($value['required'] && empty($setarr['field_'.$field])) {
                                showmessage('field_required', '', 1, array($value['title']));
                        }
                }
                
                updatetable('spacefield', $setarr, array('uid'=>$_SGLOBAL['supe_uid']));
                
                //隐私
                $inserts = array();
                foreach ($_POST['friend'] as $key => $value) {
                        $value = intval($value);
                        $inserts[] = "('base','$key','$space[uid]','$value')"; //这是要干嘛? key没过滤 11年至今未修复
                }
                if($inserts) {
                        $_SGLOBAL['db']->query("DELETE FROM ".tname('spaceinfo')." WHERE uid='$space[uid]' AND type='base'");
                        $_SGLOBAL['db']->query("INSERT INTO ".tname('spaceinfo')." (type,subtype,uid,friend)
                                VALUES ".implode(',', $inserts)); //带入了 不解释...
                }

SQL Injection 2:

通读了一遍, 除了上面那个冷饭以外还有一个地方对KEY也没做处理, 导致注射:

漏洞文件 \source\cp_privacy.php

<?php //  
.......省略.......

} elseif(submitcheck('privacy2submit')) {

        //类型筛选
        $space['privacy']['filter_icon'] = array();
        foreach ($_POST['privacy']['filter_icon'] as $key => $value) {
                $space['privacy']['filter_icon'][$key] = 1;
        }
        //用户组设置
        $space['privacy']['filter_gid'] = array();
        foreach ($_POST['privacy']['filter_gid'] as $key => $value) {
                $space['privacy']['filter_gid'][$key] = intval($value);
        }
        
        //通知筛选
        $space['privacy']['filter_note'] = array();
        foreach ($_POST['privacy']['filter_note'] as $key => $value) { //此处开始把key转到$space['privacy']['filter_note'][$key]
                $space['privacy']['filter_note'][$key] = 1;
        }
        
        privacy_update();

        //更新好友缓存
        friend_cache($_SGLOBAL['supe_uid']);

        showmessage('do_success', 'cp.php?ac=privacy&op=view');
}

if($_GET['op'] == 'view') {
        //好友组
        
        $groups = getfriendgroup();
        //屏蔽
        $filter_icons = empty($space['privacy']['filter_icon'])?array():$space['privacy']['filter_icon']; //赋值到$filter_icons
        $filter_note = empty($space['privacy']['filter_note'])?array():$space['privacy']['filter_note'];
        $iconnames = $appids = $icons = $uids = $users = array();

.......省略.......
        

foreach ($filter_icons as $key => $value) {

list($icon, $uid) = explode('|', $key); //使用|分割 将key赋值到$uid 并未做任何过滤

$icons[$key] = $icon;

$uids[$key] = $uid; //此处写进$uids也没过滤

if(is_numeric($icon)) {

$appids[$key] = $icon;

}
}

if($uids) {
                $query = $_SGLOBAL['db']->query("SELECT uid, username FROM ".tname('space')." WHERE uid IN (".simplode($uids).")"); //射了射了射了射了射了射了射了射了射了射了射了射了射了射了射了射了
                $_SGLOBAL['db']->fetch_array($query);
while ($value = $_SGLOBAL['db']->fetch_array($query)) {
                        $users[$value['uid']] = $value['username'];
                }
        }
        //获取应用名称
        if($appids) {
                $query = $_SGLOBAL['db']->query("SELECT appid, appname FROM ".tname('myapp')." WHERE appid IN (".simplode($appids).")");
                while ($value = $_SGLOBAL['db']->fetch_array($query)) {
                        $iconnames[$value['appid']] = $value['appname'];
                }
        }
        
        $cat_actives = array('view' => ' class="active"');

}

看看simplode函数吧~

function simplode($ids) {
        return "'".implode("','", $ids)."'"; //虽然有单引号, 但是程序并没有过滤post过去的KEY值, 所以在GPC=OFF的情况下可射.
}

测试图:

注意必须要先登录并且找到formhash, 登陆后源码里面就能找到

作者：Rices