uploads_edit.php SQL Injection Vul

catalog

1. 漏洞描述
2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析
5. 防御方法
6. 攻防思考

1. 漏洞描述

Dedecms 5.3版本下的member/uploads_edit.php中的未限制文件上传漏洞允许远程攻击者通过上传一个有两个扩展的文件名的文件，然后借助未知向量访问该文件而执行任意代码。这已经通过带.jpg.php的文件名所证实

Relevant Link:

http://cve.scap.org.cn/CVE-2009-2270.html
http://www.cnnvd.org.cn/vulnerability/show/cv_id/2009070008

2. 漏洞触发条件

0x1: POC

<form id="frmUpload" enctype="multipart/form-data" action="http://127.0.0.1/dedecms5.5/member/uploads_edit.php?dopost=save&title=ss&oldurl=1'.php" method="post">
<!-- oldurl是注入点 -->
    <input type="file" name="addonfile" id="addonfile" size="50"><br>
    <input name="mode" type="hidden" value="2">
    <input id="btnUpload" type="submit" value="Upload">
</form>

Relevant Link:

http://www.wooyun.org/bug.php?action=view&id=48894
http://www.2cto.com/Article/201012/80026.html

3. 漏洞影响范围
4. 漏洞代码分析

/member/uploads_edit.php

else if($dopost=='save')
{
    $title = HtmlReplace($title,2);
    if($mediatype==1) $utype = 'image';
    else if($mediatype==2)
    {
        $utype = 'flash';
    }
    else if($mediatype==3)
    {
        $utype = 'media';
    }
    else
    {
        $utype = 'addon';
    }
    $title = HtmlReplace($title,2);
    //获取"."前面的文件名
    $exname = ereg_replace("(.*)/","",$oldurl);
    //获取"."之外的扩展名
    $exname = ereg_replace("\.(.*)$","",$exname);
    //返回上传的文件名
    $filename = MemberUploads('addonfile',$oldurl,$cfg_ml->M_ID,$utype,$exname,-1,-1,true);
    //$filename带入函数查询
    SaveUploadInfo($title,$filename,$mediatype);
    ShowMsg("成功修改文件！","uploads_edit.php?aid=$aid");
}

\member\inc\inc_archives_functions.php

function SaveUploadInfo($title,$filename,$medaitype=1,$addinfos='')
{
    global $dsql,$cfg_ml,$cfg_basedir;
    if($filename=='')
    {
        return false;
    }
    if(!is_array($addinfos))
    {
        $addinfos[0] = $addinfos[1] = $addinfos[2] = 0;
    }
    if($medaitype==1)
    {
        $info = '';
        $addinfos = GetImageSize($cfg_basedir.$filename,$info);
    }
    $addinfos[2] = @filesize($cfg_basedir.$filename);
    $row = $dsql->GetOne("Select aid,title,url From `#@__uploads` where url like '$filename' And mid='".$cfg_ml->M_ID."'; ");
    $uptime = time();
    if(is_array($row))
    {
        $query = "Update `#@__uploads` set title='$title',mediatype='$medaitype',
                     width='{$addinfos[0]}',height='{$addinfos[1]}',filesize='{$addinfos[2]}',uptime='$uptime'
                     where aid='{$row['aid']}'; ";
        $dsql->ExecuteNoneQuery($query);
    }
    else
    {
        //$filename未进行过滤就带入SQL查询，造成SQL注入
        $inquery = "INSERT INTO `#@__uploads`(title,url,mediatype,width,height,playtime,filesize,uptime,mid)
           VALUES ('$title','$filename','$medaitype','".$addinfos[0]."','".$addinfos[1]."','0','".$addinfos[2]."','$uptime','".$cfg_ml->M_ID."'); ";
        $dsql->ExecuteNoneQuery($inquery);
    }
    return true;
}

5. 防御方法

/member/uploads_edit.php

else if($dopost=='save')
{
    $title = HtmlReplace($title,2);
    if($mediatype==1) $utype = 'image';
    else if($mediatype==2)
    {
        $utype = 'flash';
    }
    else if($mediatype==3)
    {
        $utype = 'media';
    }
    else
    {
        $utype = 'addon';
    }
    $title = HtmlReplace($title, 2);
    /* 对$oldurl进行有效过滤 */
    $oldurl = HtmlReplace($oldurl);
    /* */
    $exname = preg_replace("#(.*)/#", "", $oldurl);
    $exname = preg_replace("#\.(.*)$#", "", $exname);
    $filename = MemberUploads('addonfile', $oldurl, $cfg_ml->M_ID, $utype,$exname, -1, -1, TRUE);
    SaveUploadInfo($title, $filename, $mediatype);
    ShowMsg("成功修改文件！", "uploads_edit.php?aid=$aid");
}