Thinksaas某处绕过过滤的注射漏洞下载

来源:黑吧安全网 浏览:974次 时间:2014-05-05
做网站找雨过天晴工作室

Thinksaas某处绕过过滤的注射漏洞添加标签过滤不严。

今天下了一个thinksaas 最新版, 就看了看



在xfkxfk 爆了一些洞后 还是变安全了一些。 但是还是有很多依旧没过滤。



xfkxfk 爆了app/tag/action/add.php



我看的漏洞文件 app/tag/action/add_ajax.php



 

case "do":

$objname = t($_POST['objname']);
$idname = t($_POST['idname']);
$objid = t($_POST['objid']);
$tags = t($_POST['tags']);

$new['tag']->addTag($objname,$idname,$objid,$tags);

echo "<script language=JavaScript>parent.window.location.reload();</script>";

break;
}





做了过滤



function t($text) {

$text = preg_replace ( '/\[.*?\]/is', '', $text );

$text = cleanJs ( $text );

// 彻底过滤空格BY QINIAO

$text = preg_replace ( '/\s(?=\s)/', '', $text );

$text = preg_replace ( '/[\n\r\t]/', ' ', $text );

$text = str_replace ( ' ', ' ', $text );

// $text = str_replace ( ' ', '', $text );

$text = str_replace ( ' ', '', $text );

$text = str_replace ( '&', '', $text );

$text = str_replace ( '=', '', $text );

$text = str_replace ( '-', '', $text );

$text = str_replace ( '#', '', $text );

$text = str_replace ( '%', '', $text );

$text = str_replace ( '!', '', $text );

$text = str_replace ( '@', '', $text );

$text = str_replace ( '^', '', $text );

$text = str_replace ( '*', '', $text );

$text = str_replace ( 'amp;', '', $text );



$text = str_replace ( 'position', '', $text );



$text = strip_tags ( $text );

$text = htmlspecialchars ( $text );

$text = str_replace ( "'", "", $text );

return $text;

}</code>

过滤了单引号 还有各种注释。。



过滤了之后 带入了addTag



 

function addTag($objname,$idname,$objid,$tags){

if($objname != '' && $idname != '' && $objid!='' && $tags!=''){
$tags = str_replace ( ',', ',', $tags );
$arrTag = explode(',',$tags);
foreach($arrTag as $item){
$tagname = t($item);
if(strlen($tagname) < '32' && $tagname != ''){
$uptime = time();

$tagcount = $this->findCount('tag',array(
'tagname'=>$tagname,
));

if($tagcount == '0'){

$tagid = $this->create('tag',array(
'tagname'=>$tagname,
'uptime'=>$uptime,
));

$tagIndexCount = $this->findCount('tag_'.$objname.'_index',array(
$idname=>$objid,
'tagid'=>$tagid,
));

if($tagIndexCount == '0'){

$this->create("tag_".$objname."_index",array(
$idname=>$objid,
'tagid'=>$tagid,
));

}

$tagIdCount = $this->findCount("tag_".$objname."_index",array(
'tagid'=>$tagid,
));

$count_obj = "count_".$objname;

$this->update('tag',array(
'tagid'=>$tagid,
),array(
$count_obj=>$tagIdCount,
));

}else{

$tagData = $this->find('tag',array(
'tagname'=>$tagname,
));

$tagIndexCount = $this->findCount("tag_".$objname."_index",array(
$idname=>$objid,
'tagid'=>$tagData['tagid'],
));

if($tagIndexCount == '0'){

$this->create("tag_".$objname."_index",array(

$idname=>$objid,
'tagid'=>$tagData['tagid'],

));

}

$tagIdCount = $this->findCount("tag_".$objname."_index",array(
'tagid'=>$tagData['tagid'],
));

$count_obj = "count_".$objname;

$this->update('tag',array(
'tagid'=>$tagData['tagid'],
),array(
$count_obj=>$tagIdCount,
'uptime'=>$uptime,
));

}

}
}
}
}







 

$tagIndexCount = $this->findCount('tag_'.$objname.'_index',array(
$idname=>$objid,
'tagid'=>$tagid,
));







可以看到 直接$idname 做key了。



 

public function findCount($table, $conditions = null) {
$where = "";
if (is_array ( $conditions )) {
$join = array ();
foreach ( $conditions as $key => $condition ) {
$condition = $this->escape ( $condition );
$join [] = "{$key} = {$condition}";
}
$where = "WHERE " . join ( " AND ", $join );
} else {
if (null != $conditions)
$where = "WHERE " . $conditions;
}
$sql = "SELECT COUNT(*) AS ts_counter FROM " . dbprefix . "{$table} {$where}";
$result = $this->db->once_fetch_assoc ( $sql );

return $result ['ts_counter'];
}