ShopEX网上商店系统\core\include_v5\shopCore.php注入漏洞


添加时间:
2010-06-18

系统编号:
WAVDB-01659

影响版本:
ShopEX 4.8.5.45144

程序介绍:

ShopEX网上商店系统是国内最大的电子商务系统程序

漏洞分析:

\core\include_v5\shopCore.php解密后代码

 
  1. public function shopCore( )  
  2. {  
  3.                 parent::kernel( );  
  4.                 if ( isset( $_POST['spgdif'] ) )  
  5.                 {  
  6.                                 $this->spgdif( );   //进入函数  
  7.                                 exit( );  
  8.                 }  
  9.         ............................  
  10. }  
  11. public function spgdif( )  
  12. {  
  13.                 include_once( CORE_DIR."/func_ext.php" );  
  14.                 if ( $_POST['session'] && $_POST['query'] && $_POST['sign'] )    //没任何过滤  
  15.                 {  
  16.                                 if ( md5( $_POST['query'].$_POST['session']."shopex_stats" ) == $_POST['sign'] )   //MD5 验证，我们可以自己控制。  
  17.                                 {  
  18.                                                 $cert = $this->loadModel( "service/certificate" );  
  19.                                                 if ( $data = $cert->session_vaild( $_POST['session'] ) )  
  20.                                                 {  
  21.                                                                 $this->fetchdata( $_POST['query'] );  
  22.                                                 }  
  23.                                 ..........................  
  24. public function fetchdata( $params )  
  25. {  
  26.                 $params = unserialize( $params );  
  27.                 $sql = "SELECT ";  
  28.                 foreach ( $params['fields'] as $key => $value )  
  29.                 {  
  30.                                 $sql .= $value['method']."(".$value['name'].")";  
  31.                                 if ( $value['alias'] )  
  32.                                 {  
  33.                                                 $sql .= " as ".$value['alias'];  //代入sql  
  34.                                 }  
  35.                                 $sql .= ",";  
  36.                 }  
  37.                 $sql = substr( $sql, 0, -1 );  
  38.                 $sql .= " FROM ".$params['tbl']." ";  
  39.         ...............  
  40.                 $db = $this->database( );  
  41.                 ob_start( );  
  42.                 $data = $db->select( $sql );  
  43.                 ob_end_clean( );  
  44.                 if ( $data )  
  45.                 {  
  46.                                 echo json_encode( array(  
  47.                                                 "res" => "succ",  
  48.                                                 "data" => $data   //没任何干扰，全部显示出来  
  49.                                 ) );  
  50.                 }  
  51.                 else  
  52.                 {  
  53.                                 echo json_encode( array(  
  54.                                                 "res" => "fail",  
  55.                                                 "data" => $sql  
  56.                                 ) );  
  57.                 }  
  58. }  



解决方案:
厂商补丁：
ShopEX
-----------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://bbs.shopex.cn/notice.php?fid-.html#21

信息来源:
<*来源：俺是农村的
链接：http://t00ls.net
*>