{"id":402,"date":"2022-10-24T23:18:40","date_gmt":"2022-10-24T15:18:40","guid":{"rendered":"http:\/\/119.45.47.125\/?p=402"},"modified":"2023-05-10T14:20:56","modified_gmt":"2023-05-10T06:20:56","slug":"yunjing-1","status":"publish","type":"post","link":"http:\/\/119.45.47.125\/index.php\/2022\/10\/24\/yunjing-1\/","title":{"rendered":"\u6625\u79cb\u4e91\u5883\uff08\u4e00\uff09"},"content":{"rendered":"

1.CVE-2022-32991<\/h3>\n
\n
\n Web Based Quiz System SQL\u6ce8\u5165
\n \u8be5CMS\u7684welcome.php\u4e2d\u5b58\u5728SQL\u6ce8\u5165\u653b\u51fb\u3002\n<\/blockquote>\n

(1)welcome.php<\/h4>\n

u1s1\uff0c\u8fd9\u4e2a CMS \u51fa\u73b0\u8fd9\u79cd SQL \u6ce8\u5165\u633a\u6ca1\u9053\u7406\u7684\uff0c\u800c\u4e14\u8fd8\u4e0d\u6b62welcome.php<\/code>\u8fd9\u4e00\u5904<\/p>\n

\u6e90\u7801\u53ef\u4ee5\u5728\u8fd9\u91cc<\/a>\u4e0b\u8f7d\uff0c\u6253\u5f00\u73af\u5883\uff0c\u5148\u6ce8\u518c\u4e2a\u8d26\u53f7\uff0c\u7136\u540e\u76f4\u63a5\u767b\u9646\u8fdb\u53bb\u5c31\u662fwelcome.php<\/code><\/p>\n

\u4ece\u6e90\u7801\u91cc\u6252\u4e00\u4e0b\uff0c\u95ee\u9898\u5176\u5b9e\u5f88\u660e\u663e<\/p>\n

<?php\nif(@$_GET['q']=='quiz' && @$_GET['step']==2)\n{\n    $eid=@$_GET['eid'];\n    $sn=@$_GET['n'];\n    $total=@$_GET['t'];\n    $q=mysqli_query($con,\"SELECT * FROM questions WHERE eid='$eid' AND sn='$sn' \" );\n    echo '<div class=\"panel\" style=\"margin:5%\">';\n    while($row=mysqli_fetch_array($q) )\n    {\n        $qns=$row['qns'];\n        $qid=$row['qid'];\n        echo '<b>Question \u00a0'.$sn.'\u00a0::<br \/><br \/>'.$qns.'<\/b><br \/><br \/>';\n    }\n    $q=mysqli_query($con,\"SELECT * FROM options WHERE qid='$qid' \" );\n    echo '<form action=\"update.php?q=quiz&step=2&eid='.$eid.'&n='.$sn.'&t='.$total.'&qid='.$qid.'\" method=\"POST\"  class=\"form-horizontal\"><br \/>';\n    ...\n?>\n<\/code><\/pre>\n
eid<\/code>\u548csn<\/code>\u662f\u6ca1\u6709\u505a\u4efb\u4f55\u5904\u7406\u76f4\u63a5\u62fc\u63a5\u8fc7\u6765\u7684\uff0c\u6240\u4ee5\u4e24\u4e2a\u70b9\u90fd\u6709\u6ce8\u5165\uff0c\u5f88\u5e38\u89c4\u7684\u5b57\u7b26\u578b\u6ce8\u5165\uff0c\u76f4\u767d\u70b9\uff0c\u5c31\u662f sqlilabs-1\uff0c\u5224\u65ad\u51fa\u6765 5 \u5217\uff0c\u5728\u7b2c\u4e09\u4e2a\u4f4d\u7f6e\u4e0a\u56de\u663e\uff0c\u624b\u5de5\u53ef\u4ee5\u4e00\u628a\u68ad\u7684\uff0c\u5f53\u7136 sqlmap \u66f4\u5feb<\/p>\n
\"\"<\/div>\n
\"\"<\/div>\n
\u540c\u6837\uff0cn<\/code>\u4e5f\u53ef\u4ee5\u64cd\u4f5c<\/p>\n
\"\"<\/div>\n
(2)update.php<\/h4>\n
\u518d\u770b\u770b\u5176\u4ed6\u90e8\u5206\uff0c\u540e\u53f0\u767b\u9646\u5728 admin.php<\/code>\uff0c\u9ed8\u8ba4\u7528\u6237\u540d\u5bc6\u7801\u5373\u53ef\u767b\u9646\uff0c\u4e0a\u53bb\u540e\u5c31\u662f\u540e\u53f0\u7ef4\u62a4\u66f4\u65b0\u7684\u76f8\u5173\u529f\u80fd\uff0c\u597d\u5de7\u4e0d\u5de7\uff0c\u5728update.php<\/code>\u91cc\u4e5f\u6709\u7c7b\u4f3c\u7684\u95ee\u9898<\/p>\n
<?php\nif(@$_GET['q']=='quiz' && @$_GET['step']==2)\n{\n    $eid=@$_GET['eid'];\n    $sn=@$_GET['n'];\n    $total=@$_GET['t'];\n    $ans=$_POST['ans'];\n    $qid=@$_GET['qid'];\n    $q=mysqli_query($con,\"SELECT * FROM answer WHERE qid='$qid' \" );\n    }\n?>\n<\/code><\/pre>\n
\u4e00\u6837\u7684\u6bdb\u75c5\uff0cpid<\/code>\u6ca1\u5904\u7406\uff0c\u76f4\u63a5\u5224\u65ad\u4e24\u5217\uff0c\u4e0d\u8003\u8651\u56de\u663e\uff0c\u76f4\u63a5sleep()<\/code>\u5ef6\u65f6\u5904\u7406\u5b8c\u4e8b<\/p>\n
\"\"<\/div>\n
\u8fd9\u4e2a\u6211\u770b\u5df2\u7ecf\u6709\u5e08\u5085\u63d0\u4ea4\u4e86 CVE-2022-35422<\/a><\/p>\n
(3)admin.php<\/h4>\n
\u5176\u4ed6\u90e8\u5206\u7684\u4ee3\u7801\u662f\u4e0d\u662f\u4e5f\u6709\u70b9\u95ee\u9898\uff1f<\/p>\n
<?php\n\nif(isset($_POST['submit']))\n    {   \n        $email = $_POST['email'];\n        $password = $_POST['password'];\n\n        $email = stripslashes($email);\n        $email = addslashes($email);\n        $password = stripslashes($password); \n        $password = addslashes($password);\n\n        $email = mysqli_real_escape_string($con,$email);\n        $password = mysqli_real_escape_string($con,$password);\n\n        $result = mysqli_query($con,\"SELECT email FROM admin WHERE email = '$email' and password = '$password'\") or die('Error');\n        $count=mysqli_num_rows($result);\n<\/code><\/pre>\n
email<\/code>\u548cpassword<\/code>\u505a\u4e86\u4e00\u4e9b\u5904\u7406\uff0csripslashes()->addslashes()->mysqli_real_escape_string()<\/code>\uff0c\u4f46\u662f\u6211\u6ca1\u8bb0\u9519\u7684\u8bdd\u8fd9\u5e94\u8be5\u662f\u53ef\u4ee5\u5bbd\u5b57\u7b26\u7ed5\u8fc7\u5427\ud83e\udd14<\/del><\/p>\n
\"\"<\/div>\n
\n
2.CVE-2022-30887<\/h3>\n
\n
\n  Pharmacy Management System shell upload
\n  \u591a\u8bed\u8a00\u836f\u623f\u7ba1\u7406\u7cfb\u7edf (MPMS) \u662f\u7528 PHP \u548c MySQL \u5f00\u53d1\u7684, \u8be5\u8f6f\u4ef6\u7684\u4e3b\u8981\u76ee\u7684\u662f\u5728\u836f\u623f\u548c\u5ba2\u6237\u4e4b\u95f4\u63d0\u4f9b\u4e00\u5957\u63a5\u53e3\uff0c\u5ba2\u6237\u662f\u8be5\u8f6f\u4ef6\u7684\u4e3b\u8981\u7528\u6237\u3002\u8be5\u8f6f\u4ef6\u6709\u52a9\u4e8e\u4e3a\u836f\u623f\u4e1a\u52a1\u521b\u5efa\u4e00\u4e2a\u7efc\u5408\u6570\u636e\u5e93\uff0c\u5e76\u6839\u636e\u5230\u671f\u3001\u4ea7\u54c1\u7b49\u5404\u79cd\u53c2\u6570\u63d0\u4f9b\u5404\u79cd\u62a5\u544a\u3002 \u8be5CMS\u4e2dphp_action\/editProductImage.php\u5b58\u5728\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\uff0c\u8fdb\u800c\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\n<\/blockquote>\n
\u6e90\u7801\u8fd8\u662f\u5728\u4e0a\u9762\u7684\u7f51\u7ad9\u4e0b\uff0c\u6252\u4e0b\u6765\u76f4\u63a5\u5ba1\u8ba1<\/p>\n
(1)login.php<\/h4>\n
\u9996\u5148\u7b2c\u4e00\u4e2a\uff0clogin.php<\/code>\u5b58\u5728 SQL\u6ce8\u5165<\/p>\n
<?php\n\nif($_POST) {    \n\n  $email = $_POST['email'];\n  $password = $_POST['password'];\n\n  if(empty($email) || empty($password)) {\n    if($email == \"\") {\n      $errors[] = \"email is required\";\n    } \n\n    if($password == \"\") {\n      $errors[] = \"Password is required\";\n    }\n  } else {\n    $sql = \"SELECT * FROM users WHERE email = '$email'\";\n    $result = $connect->query($sql);\n\n    if($result->num_rows == 1) {\n      $password = md5($password);\n      \/\/ exists\n      $mainSql = \"SELECT * FROM users WHERE email = '$email' AND password = '$password'\";\n      $mainResult = $connect->query($mainSql);\n<\/code><\/pre>\n
\u53ef\u4ee5\u5f88\u6e05\u6670\u5730\u770b\u5230email<\/code>\u6ca1\u6709\u505a\u4efb\u4f55\u5904\u7406\uff0c\u5b57\u7b26\u578b\u6ce8\u5165\uff0c\u653e\u5230sqlmap<\/code>\u91cc\u53ef\u4ee5\u6d4b\u51fa\u6765\u6709\u5ef6\u65f6\u6ce8\u5165<\/p>\n
\"\"<\/div>\n
(2)editProductImage.php<\/h4>\n
<?php\n\nif($_POST) {\n    $image = $_FILES['productImage']['name'];\n    $target = \"..\/assets\/myimages\/\".basename($image);\n\n    if (move_uploaded_file($_FILES['productImage']['tmp_name'], $target)) {\n \/\/ @unlink(\"uploadImage\/Profile\/\".$_POST['old_image']);\n    \/\/echo $_FILES['image']['tmp_name'];\n    \/\/cho $target;exit;\n        $msg = \"Image uploaded successfully\";\n        echo $msg;\n    }\n    else{\n        $msg = \"Failed to upload image\";\n        echo $msg;exit;\n    }\n    $sql = \"UPDATE product SET product_image = '$image' WHERE product_id = $productId\";\n\/\/echo $sql;exit;\n    if($connect->query($sql) === TRUE) {\n        $valid['success'] = true;\n        $valid['messages'] = \"Successfully Updated\";\n        header('location:..\/product.php');\n    }\n...\n?>\n<\/code><\/pre>\n
\u76f4\u63a5\u4f20\u5c31\u884c\uff0c\u8bbf\u95eeassets\/myimages\/phpinfo.php<\/code>\u5373\u53ef<\/p>\n
\"\"<\/div>\n
\"\"<\/div>\n
\n
3.CVE-2022-28525<\/h3>\n
\n
\n  ED01-CMS v20180505 \u5b58\u5728\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\n<\/blockquote>\n
5 \u5e74\u524d\u5c31\u505c\u6b62\u66f4\u65b0\u7684 CMS\uff0c\u6d1e\u4e0d\u6b62\u4e00\u4e2a<\/p>\n
(1)admin_includes\/admin_edit_user.php<\/h4>\n
\u76f4\u63a5 admin\/admin \u8fdbadmin.php<\/code>\uff0c\u7136\u540e\u5728admin\/users.php?source=edit_user&id=<\/code>\u9875\u9762\u4e0b\u5b58\u5728\u6587\u4ef6\u4e0a\u4f20\u70b9\uff0c\u770b\u4e0b\u6e90\u7801\uff0c\u5c5e\u4e8eadmin_includes\/admin_edit_user.php<\/code><\/p>\n
<?php\n...\nswitch($_POST['user_image']) {\n    case \"none\":\n        $user_image = \"default.png\";\n        break;\n    case \"new\":\n        $user_image = $_FILES['new_image']['name'];\n        break;\n    default:\n        $user_image = $_POST['user_image'];\n}\n$image_tmp = $_FILES['new_image']['tmp_name'];\nmove_uploaded_file($image_tmp, \"..\/images\/$user_image\");\n...\n    ?>\n<\/code><\/pre>\n
\u76f4\u63a5\u4f20\u6ca1\u963b\u788d\u7684\u90a3\u79cd\uff0c\u76f4\u63a5\u8bbf\u95ee\u5c31\u884cimages\/phpinfo.php<\/code><\/p>\n
\"\"<\/div>\n
(2)admin_includes\/admin_add_post.php<\/h4>\n
\u8001\u95ee\u9898\uff0c\u6ca1\u963b\u788d\uff0c\u76f4\u63a5\u4f20<\/p>\n
<?php\n...\nif(isset($_POST['addpostsubmit'])) {\n    $author = mysqli_real_escape_string($con, $_POST['post_author']);\n    $title = mysqli_real_escape_string($con, $_POST['post_title']);\n    $cat = $_POST['post_category'];\n    $status = mysqli_real_escape_string($con, $_POST['post_status']);\n    $tags = mysqli_real_escape_string($con, $_POST['post_tags']);\n    $image = mysqli_real_escape_string($con, $_FILES['post_image']['name']);\n    $image_tmp = $_FILES['post_image']['tmp_name'];\n    $content = mysqli_real_escape_string($con, $_POST['post_content']);\n    move_uploaded_file($image_tmp, \"..\/images\/$image\");\n...\n    ?>\n<\/code><\/pre>\n
\u8fd8\u662f\u5728 images<\/code>\u4e0b<\/p>\n
\"\"<\/div>\n
\"\"<\/div>\n
(3)admin_includes\/admin_add_users.php<\/h4>\n
\u540c\u7406\uff0c\u76f4\u63a5\u4f20\uff0c\u5904\u7406\u65b9\u5f0f\u90fd\u4e00\u6837\u7684<\/p>\n
<?php\n...\n$image_tmp = $_FILES['user_image']['tmp_name'];\n...\nmove_uploaded_file($image_tmp, \"..\/images\/$user_image\");\n...\n?>\n<\/code><\/pre>\n
(4)admin_includes\/admin_cat_logic.php<\/h4>\n
\u7ecf\u5178\u7684\u6570\u5b57\u578b SQL \u6ce8\u5165<\/p>\n
<?php\n...\nif(isset($_GET['edit'])) {\n    $edit_id = $_GET['edit'];\n    $edit_query = \"SELECT * FROM cms_categories WHERE cms_categories.cat_id = $edit_id\";\n    $edit_result = mysqli_query($con, $edit_query);\n    \/\/ $edit_cat is the array containing 'cat_id' and 'cat_title'\n    $edit_cat = mysqli_fetch_array($edit_result);\n...\n?>\n<\/code><\/pre>\n
\u53ef\u4ee5\u76f4\u63a5\u62a5\u9519\u6ce8\u5165\u4e00\u628a\u68ad<\/p>\n
\"\"<\/div>\n
\n
4.CVE-2022-28512<\/h3>\n
\n
\n  Fantastic Blog (CMS) SQL\u6ce8\u5165
\n  Fantastic Blog (CMS)\u662f\u4e00\u4e2a\u7edd\u5bf9\u51fa\u8272\u7684\u535a\u5ba2\/\u6587\u7ae0\u7f51\u7edc\u5185\u5bb9\u7ba1\u7406\u7cfb\u7edf\u3002\u5b83\u4f7f\u60a8\u53ef\u4ee5\u8f7b\u677e\u5730\u7ba1\u7406\u60a8\u7684\u7f51\u7ad9\u6216\u535a\u5ba2\uff0c\u5b83\u4e3a\u60a8\u63d0\u4f9b\u4e86\u5e7f\u6cdb\u7684\u529f\u80fd\u6765\u5b9a\u5236\u60a8\u7684\u535a\u5ba2\u4ee5\u6ee1\u8db3\u60a8\u7684\u9700\u6c42\u3002\u5b83\u5177\u6709\u5f3a\u5927\u7684\u529f\u80fd\uff0c\u60a8\u65e0\u9700\u63a5\u89e6\u4efb\u4f55\u4ee3\u7801\u5373\u53ef\u542f\u52a8\u5e76\u8fd0\u884c\u60a8\u7684\u535a\u5ba2\u3002 \u8be5CMS\u7684\/single.php\u8def\u5f84\u4e0b\uff0cid\u53c2\u6570\u5b58\u5728\u4e00\u4e2aSQL\u6ce8\u5165\u6f0f\u6d1e\n<\/blockquote>\n
(1)single.php<\/h4>\n
<?php\n$id=$_REQUEST['id']; \n$query=\"SELECT * from blogs where id='\".$id.\"'\";\n$result=mysqli_query($GLOBALS[\"___mysqli_ston\"],$query) or die ( ((is_object($GLOBALS[\"___mysqli_ston\"]))? mysqli_error($GLOBALS[\"___mysqli_ston\"]) : (($___mysqli_res = mysqli_connect_error()) ?$___mysqli_res : true)));\n<\/code><\/pre>\n
\u5b57\u7b26\u578b\u76f4\u63a5\u6ce8\u5c31\u884c<\/p>\n
\/single.php?id=1%27 union select 1,2,3,4,5,6,7,8,9%23<\/code><\/p>\n
\u76f4\u63a5sqlmap<\/code>\u68ad\u4e86<\/p>\n
(2)category.php<\/h4>\n
\u548c\u4e0a\u9762\u4e00\u6837\uff0c\u4ee3\u7801\u90fd\u6ca1\u53d8<\/p>\n
(3)search.php<\/h4>\n
\u8fd9\u5757\u6709\u4e00\u5904 XSS\uff0c\u57fa\u4e8e\u641c\u7d22\u529f\u80fd\u7684\uff1b\u76f4\u63a5\u5728keyword<\/code>\u90a3\u91cc\u8f93\u5165<img src=x onerror=alert(1)><\/code> \u5c31\u884c<\/p>\n
\"\"<\/div>","protected":false},"excerpt":{"rendered":"1.CVE-2022-32991 Web Based Quiz System SQL\u6ce8\u5165 \u8be5CMS\u7684welco […]","protected":false},"author":1,"featured_media":404,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[26,29],"tags":[31],"class_list":["post-402","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-study","category-yunjing","tag-31"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/119.45.47.125\/wp-content\/uploads\/2022\/10\/1-11.png?fit=1731%2C835","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/posts\/402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/comments?post=402"}],"version-history":[{"count":22,"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/posts\/402\/revisions"}],"predecessor-version":[{"id":640,"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/posts\/402\/revisions\/640"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/media\/404"}],"wp:attachment":[{"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/media?parent=402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/categories?post=402"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/119.45.47.125\/index.php\/wp-json\/wp\/v2\/tags?post=402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}