dedecms /member/edit_baseinfo.php SQL Injection Vul

1. 漏洞描述
2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析
5. 防御方法
6. 攻防思考

http://www.grabsun.com/article/2015/1216455.html

1. 注册用户并且登陆
2. 打开http://127.0.0.1/dedecms5.5/member/edit_baseinfo.php
3. 填写完毕后，输入验证码，点击提交，打开BURP 抓包
4. 然后再BURP里修改newsafequestion 的值改成: 1‘,email=@`‘`,uname=(select user()),email=‘sss
5. 然后提交 之后再打开http://127.0.0.1/dedecms5.5/member/edit_baseinfo.php
6. 就可以看到自己的、用户名变成了注入之后的结果了

http://www.wooyun.org/bugs/wooyun-2014-048873

..
 //修改安全问题
if($newsafequestion != 0 && $newsafeanswer != ‘‘)
{
    if(strlen($newsafeanswer) > 30)
    {
        ShowMsg(‘你的新安全问题的答案太长了，请保持在30字节以内！‘,‘-1‘);
        exit();
    }
    else
    {
        //这里的newsafequest没过滤，黑客可以将SQL代码注入到$addupquery中，用于之后的SQL查询
        $addupquery .= ",safequestion=‘$newsafequestion‘,safeanswer=‘$newsafeanswer‘";
    }
}
..
//带入SQL查询
$query1 = "Update `#@__member` set pwd=‘$pwd‘,sex=‘$sex‘{$addupquery} where mid=‘".$cfg_ml->M_ID."‘ ";
$dsql->ExecuteNoneQuery($query1);

..
//修改安全问题
if($newsafequestion != 0 && $newsafeanswer != ‘‘)
{
    if(strlen($newsafeanswer) > 30)
    {
    ShowMsg(‘你的新安全问题的答案太长了，请保持在30字节以内！‘,‘-1‘);
    exit();
    }
    else
    {
    /* 过滤 */
            $newsafequestion = HtmlReplace($newsafequestion,1);
            $newsafeanswer = HtmlReplace($newsafeanswer,1);
    /* */
    $addupquery .= ",safequestion=‘$newsafequestion‘,safeanswer=‘$newsafeanswer‘";
    }
}
..
$query1 = "UPDATE `#@__member` SET pwd=‘$pwd‘,sex=‘$sex‘{$addupquery} where mid=‘".$cfg_ml->M_ID."‘ ";
$dsql->ExecuteNoneQuery($query1);