Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pbootcms #1

Open
M40k1n9 opened this issue Mar 9, 2021 · 0 comments
Open

pbootcms #1

M40k1n9 opened this issue Mar 9, 2021 · 0 comments

Comments

@M40k1n9
Copy link
Owner

M40k1n9 commented Mar 9, 2021

PbootCMS 3.0.4 has SQL injection

Submitter name :

Vulnerability Type :

SQL Injection

Vulnerability Version :

3.0.4

Recurring environment:

  • Windows 10
  • PHP 5.4.5
  • Apache 2.4.23
  • Mysql 5.6.27

Vulnerability Description AND recurrence:

The default database is sqlite. For testing convenience, we need to replace the default database with the mysql database.
the mysql database directory:
pbootcms\static\backup\sql\0cb2353f8ea80b398754308f15d1121e_20200705235534_pbootcms.sql

image

Boolean-based blind SQL injection happened in this page.
'$_ POST' sends an index array.
The values in the array are brought into the "where" condition in the form of "and".

image

When the condition is true:

image
image

When the condition is false:

image
image

payload:
Because the data is filtered, only 'regexp' can be used for regular matching.
For example: "username = admin" can be expressed as "username regepx 0x5E612E2A", where "5E612E2A" is the hex code of "^ a. *"
image
image

and we can get the admin account name and password

Detailed information:
1:
Vulnerability code:core\basic\Model.php

image

When the passed in parameter $where is an array, traverse the array, and when $where is an index array:$where_string.=$value。

2:Find the code to pass in the ‘where’ function as an index array:
Route:apps\home\controller\ParserController.php
In 'parserSearchLabel()', the incoming data is assigned to the variable "$receive" for traversal, and "$key" is brought into "request()" for filtering.

image
image
image
image
image
image
image
image
image

The values of the index array passed in through the above methods can only contain Chinese, letters, numbers, horizontal lines, dots, commas and spaces! It is encoded by 'htmlspecialchars()' and 'addslashes()'.
Finally, it is passed to '$where3'.

image
image
image

The '$where3' in 'getlists()' is controllable, and it will be brought into the statement in the form of 'and'.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant