发布日期：2010-06-29
更新日期：2010-06-30

受影响系统：

上海商派网络科技有限公司 ShopEx 4.8.5.45144

描述：

---

ShopEx是在国内非常流行的网上商店平台软件。

ShopEx的\core\include_v5\shopCore.php页面没有正确地过滤用户所提交的请求参数，远程攻击者可以通过提交恶意请求执行SQL注入攻击。

public function shopCore( )  
{  
                parent::kernel( );  
                if ( isset( $_POST['spgdif'] ) )  
                {  
                                $this->spgdif( );   //进入函数  
                                exit( );  
                }  
        ............................  
}  
public function spgdif( )  
{  
                include_once( CORE_DIR."/func_ext.php" );  
                if ( $_POST['session'] && $_POST['query'] && $_POST['sign'] )    //没任何过滤  
                {  
                                if ( md5( $_POST['query'].$_POST['session']."shopex_stats" ) == $_POST['sign'] )   //MD5 验证，我们可以自己控制。  
                                {  
                                                $cert = $this->loadModel( "service/certificate" );  
                                                if ( $data = $cert->session_vaild( $_POST['session'] ) )  
                                                {  
                                                                $this->fetchdata( $_POST['query'] );  
                                                }  
                                ..........................  
public function fetchdata( $params )  
{  
                $params = unserialize( $params );  
                $sql = "SELECT ";  
                foreach ( $params['fields'] as $key => $value )  
                {  
                                $sql .= $value['method']."(".$value['name'].")";  
                                if ( $value['alias'] )  
                                {  
                                                $sql .= " as ".$value['alias'];  //代入sql  
                                }  
                                $sql .= ",";  
                }  
                $sql = substr( $sql, 0, -1 );  
                $sql .= " FROM ".$params['tbl']." ";  
        ...............  
                $db = $this->database( );  
                ob_start( );  
                $data = $db->select( $sql );  
                ob_end_clean( );  
                if ( $data )  
                {  
                                echo json_encode( array(  
                                                "res" => "succ",  
                                                "data" => $data   //没任何干扰，全部显示出来  
                                ) );  
                }  
                else  
                {  
                                echo json_encode( array(  
                                                "res" => "fail",  
                                                "data" => $sql  
                                ) );  
                }  
}

<*来源：http://t00ls.net
  
  链接：http://wavdb.com/vuln/1671
*>

建议：

---

厂商补丁：

上海商派网络科技有限公司
------------------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://bbs.shopex.cn/notice.php?fid-.html#21

浏览次数：5944
严重程度：0（网友投票）