XOOPS 1.3.X版,2.0.X版到2.0.5版
描述：
Xoops存在SQL注入缺陷
詳細：
XOOPS是一款用PHP編寫的動態WEB站台程序。
XOOPS程序banners.php文件中的代碼存在錯誤，允許未經授權的使用者重定義本地變量並注入SQL命令：
代碼: 選擇全部
Code: [Copy to clipboard]
<?
[...]
function EmailStats($login, $cid, $bid, $pass)
{
global $xoopsDB, $xoopsConfig;
$result2 = $xoopsDB->query("select name, email from
".$xoopsDB->prefix("bannerclient")." where cid=$cid");
list($name, $email) = $xoopsDB->fetchRow($result2);
if ( $email == "" ) {
redirect_header("banners.php",3,"There isn't an email associated with
client ".$name.".<br />Please contact the Administrator");
exit();
} else {
$result = $xoopsDB->query("select bid, imptotal, impmade, clicks,
imageurl, clickurl, date from ".$xoopsDB->prefix("banner")." where bid=$bid
and cid=$cid");
list($bid, $imptotal, $impmade, $clicks, $imageurl, $clickurl, $date) =
$xoopsDB->fetchRow($result);
[...]
$fecha = date("F jS Y, h:iA.");
$subject = "Your Banner Statistics at ".$xoopsConfig[sitename]."";
$message = "Following are the complete stats for your advertising
investment at ". $xoopsConfig['sitename']." :
Client Name:
$name
Banner ID: $bid
Banner Image: $imageurl
Banner URL:
$clickurl
Impressions Purchased: $imptotal
Impressions Made:
$impmade
Impressions Left: $left
Clicks Received: $clicks
Clicks Percent:
$percent%
Report Generated on: $fecha";
$xoopsMailer =& getMailer();
$xoopsMailer->useMail();
$xoopsMailer->setToEmails($email);
$xoopsMailer->setFromEmail($xoopsConfig['adminmail']);
$xoopsMailer->setFromName($xoopsConfig['sitename']);
$xoopsMailer->setSubject($subject);
$xoopsMailer->setBody($message);
$xoopsMailer->send();
redirect_header("banners.php?op=Ok&login=$login&pass=$pass",3,"Stati
stics
for your banner has been sent to your email address.");
//include "footer.php";
exit();
}
}
function change_banner_url_by_client($login, $pass, $cid, $bid, $url)
{
global $xoopsDB;
$result = $xoopsDB->query("select passwd from
".$xoopsDB->prefix("bannerclient")." where cid=".$cid."");
list($passwd) = $xoopsDB->fetchRow($result);
if ( $pass == $passwd ) {
$xoopsDB->queryF("update ".$xoopsDB->prefix("banner")." set
clickurl='".$url."' where bid=".$bid."");
}
redirect_header("banners.php?op=Ok&login=$login&pass=$pass",3,"URL
has been changed.");
//include "footer.php";
exit();
}
[...] [code]Code: [Copy to clipboard]
function change_banner_url_by_client($login, $pass, $cid, $bid, $url)
{
global $xoopsDB;
if ( !empty($cid) AND !empty($bid) AND !empty($pass) ){
$result = $xoopsDB->query("select passwd from
".$xoopsDB->prefix("bannerclient")." where cid='".$cid."'");
list($passwd) = $xoopsDB->fetchRow($result);
if ( $pass == $passwd ) {
$xoopsDB->queryF("update ".$xoopsDB->prefix("banner")." set
clickurl='".$url."' where bid='".$bid."'");
}
redirect_header("banners.php?op=Ok&login=$login&pass=$pass",3,"URL
has been changed.");
//include "footer.php";
}
exit();
}
在“switch($op) {”前添加下列代碼：
$cid = intval($cid);
$bid = intval($bid);case "Change":
change_banner_url_by_client($login, $pass, $cid, $bid, $url);
break;
case "EmailStats":
EmailStats($login, $cid, $bid, $pass);
break;
[...]
}
?> [/code]
攻擊者通通過向目標服務器提交精心構造的下列格式的URL請求能触發該缺陷：
http://[target]/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20'a%'/*
攻擊方法：
示例代碼：
http://[target]/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20'a%'/*
解決方案：
用下列代碼替換banners.php文件中的change_banner_url_by_client()函數：