CMSEasySQL注入漏洞

 申明：分析分析，这个洞也不是我挖掘的。

 

漏洞定位在  /lib/default/archive_act.php  。感觉这个文件已经爆了好多问题了。

function orders_action() {
        $this->view->aid = trim(front::get('aid'));  //去除字符串首尾的空白字符给list->view-aid
        if (front::post('submit')) {
         $this->orders = new orders();
 
         $row = $this->orders->getrow("","adddate DESC");
 
         //var_dump(time());
 
         if($row['adddate'] && time() - $row['adddate'] <= intval(config::get('order_time'))){
 
         alerterror('操作频繁,请稍后再试');
 
         return;
 
         }
 
            if (front::$post['telphone'] == '') {
 
                alerterror('联系电话为必填！');
 
                return;
 
            }
 
            front::$post['mid'] = $this->view->user['userid'] ? $this->view->user['userid'] : 0;
 
            front::$post['adddate'] = time();
 
            front::$post['ip'] = front::ip();
 
            if (isset(front::$post['aid'])) {
 
                $aidarr = front::$post['aid'];
 
                unset(front::$post['aid']);
 
                foreach ($aidarr as $val) {
 
                    front::$post['aid'].=$val . ',';
 
                    front::$post['pnums'].=front::$post['thisnum'][$val] . ',';
 
                }
 
            } else {
 
                front::$post['aid'] = $this->view->aid;
 
            }
 
            if (!isset(front::$post['logisticsid']))
 
                front::$post['logisticsid'] = 0;
 
            front::$post['oid'] = date('YmdHis') . '-' . front::$post['logisticsid'] . '-' . front::$post['mid'] . '-' . front::$post['payname'];
 
             
 
            $insert = $this->orders->rec_insert(front::$post);
 
            if ($insert < 1) {
 
                front::flash($this->tname . lang('添加失败！'));
 
            } else {
 
             if (config::get('sms_on') && config::get('sms_order_on')) {
 
             sendMsg(front::$post['telphone'], config::get('sms_order'));
 
             }
 
             if (config::get('sms_on') && config::get('sms_order_admin_on') && $mobile = config::get('site_mobile')) {
 
             sendMsg($mobile, '网站在' . date('Y-m-d H:i:s') . '有新订单了');
 
             //echo 11;
 
             }
 
             $user = $this->view->user;
 
             if(config::get('email_order_send_cust') && $user['e_mail']){
 
             $title = "您在".config::get('sitename')."的订单".front::get('oid')."已提交";
 
             $this->sendmail($user['e_mail'], $title, $title);
 
             }
 
             if(config::get('email_order_send_admin') && config::get('email')){
 
             $title = '网站在' . date('Y-m-d H:i:s') . '有新订单了';
 
             $this->sendmail(config::get('email'), $title, $title);
 
             }
 
                if (front::$post['payname'] && front::$post['payname'] != 'nopay') {
 
                     
 
                    echo '<script type="text/javascript">alert("' . lang('orderssuccess') . ' ' . lang('现在转入支付页面') . '");window.location.href="' . url('archive/payorders/oid/' . front::$post['oid'], true) . '";</script>';
 
                }
 
                echo '<script type="text/javascript">alert("' . lang('orderssuccess') . '");window.location.href="' . url('archive/orders/oid/' . front::$post['oid'], true) . '";</script>';
 
            }
 
 
front::$post['ip'] = front::ip();
 
我们来看看这里的ip()函数：
 
static function ip() {
 
        if ($_SERVER['HTTP_CLIENT_IP']) {
 
            $onlineip = $_SERVER['HTTP_CLIENT_IP'];
 
        }
 
        elseif ($_SERVER['HTTP_X_FORWARDED_FOR']) {
 
            $onlineip = $_SERVER['HTTP_X_FORWARDED_FOR'];
 
        }
 
        elseif ($_SERVER['REMOTE_ADDR']) {
 
            $onlineip = $_SERVER['REMOTE_ADDR'];
 
        }
 
        else {
 
            $onlineip = $_SERVER['REMOTE_ADDR'];
 
        }
 
if(config::get('ipcheck_enable')){
 
if(!preg_match('/^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/', $onlineip)&&!preg_match('@^\s*((([0-9A-Fa-f]{1,4}:){7}(([0-9A-Fa-f]{1,4})|:))|(([0-9A-Fa-f]{1,4}:){6}(:|((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})|(:[0-9A-Fa-f]{1,4})))|(([0-9A-Fa-f]{1,4}:){5}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(([0-9A-Fa-f]{1,4}:){4}(:[0-9A-Fa-f]{1,4}){0,1}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(([0-9A-Fa-f]{1,4}:){3}(:[0-9A-Fa-f]{1,4}){0,2}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(([0-9A-Fa-f]{1,4}:){2}(:[0-9A-Fa-f]{1,4}){0,3}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(([0-9A-Fa-f]{1,4}:)(:[0-9A-Fa-f]{1,4}){0,4}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(:(:[0-9A-Fa-f]{1,4}){0,5}((:((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})?)|((:[0-9A-Fa-f]{1,4}){1,2})))|(((25[0-5]|2[0-4]\d|[01]?\d{1,2})(\.(25[0-5]|2[0-4]\d|[01]?\d{1,2})){3})))(%.+)?\s*$@', $onlineip)){
 
exit('来源非法');
 
}
 
}
 
        return $onlineip;
 
    }