seacmsv9 注入漏洞 破解管理员账户+密码

漏洞背景：

SQL 注入攻击是当前网络安全中最常见的一种攻击方式，攻击者可以利用该漏洞访问或操作数据库，造成数据泄露或破坏。通常发生在开发人员未能正确处理用户输入时。

在 SeaCMS V9 中，用户输入（如登录、评论、分页、ID 等）未经过适当的验证和清理，直接嵌入到 SQL 查询中，导致了 SQL 注入攻击的发生

漏洞文件：

./comment/api/index.php，漏洞参数：$rlist

漏洞源码：

session_start();
require_once("../../include/common.php");
$id = (isset($gid) && is_numeric($gid)) ? $gid : 0;
$page = (isset($page) && is_numeric($page)) ? $page : 1;
$type = (isset($type) && is_numeric($type)) ? $type : 1;
$pCount = 0;
$jsoncachefile = sea_DATA."/cache/review/$type/$id.js";
//缓存第一页的评论
if($page<2)
{
        if(file_exists($jsoncachefile))
        {
                $json=LoadFile($jsoncachefile);
                die($json);
        }
}
$h = ReadData($id,$page);
$rlist = array();
if($page<2)
{
        createTextFile($h,$jsoncachefile);
}
die($h);        
 
function ReadData($id,$page)
{
        global $type,$pCount,$rlist;
        $ret = array("","",$page,0,10,$type,$id);
        if($id>0)
        {
                $ret[0] = Readmlist($id,$page,$ret[4]);
                $ret[3] = $pCount;
                $x = implode(',',$rlist);
                if(!empty($x))
                {
                $ret[1] = Readrlist($x,1,10000);
                }
        }
        $readData = FormatJson($ret);
        return $readData;
}
 
function Readmlist($id,$page,$size)
{
        global $dsql,$type,$pCount,$rlist;
        $ml=array();
        if($id>0)
        {
                $sqlCount = "SELECT count(*) as dd FROM sea_comment WHERE m_type=$type AND v_id=$id ORDER BY id DESC";
                $rs = $dsql ->GetOne($sqlCount);
                $pCount = ceil($rs['dd']/$size);
                $sql = "SELECT id,uid,username,dtime,reply,msg,agree,anti,pic,vote,ischeck FROM sea_comment WHERE m_type=$type AND v_id=$id ORDER BY id DESC limit ".($page-1)*$size.",$size ";
                $dsql->setQuery($sql);
                $dsql->Execute('commentmlist');
                while($row=$dsql->GetArray('commentmlist'))
                {
                        $row['reply'].=ReadReplyID($id,$row['reply'],$rlist);
                        $ml[]="{\"cmid\":".$row['id'].",\"uid\":".$row['uid'].",\"tmp\":\"\",\"nick\":\"".$row['username']."\",\"face\":\"\",\"star\":\"\",\"anony\":".(empty($row['username'])?1:0).",\"from\":\"".$row['username']."\",\"time\":\"".date("Y/n/j H:i:s",$row['dtime'])."\",\"reply\":\"".$row['reply']."\",\"content\":\"".$row['msg']."\",\"agree\":".$row['agree'].",\"aginst\":".$row['anti'].",\"pic\":\"".$row['pic']."\",\"vote\":\"".$row['vote']."\",\"allow\":\"".(empty($row['anti'])?0:1)."\",\"check\":\"".$row['ischeck']."\"}";
                }
        }
        $readmlist=join($ml,",");
        return $readmlist;
}
 
function Readrlist($ids,$page,$size)
{
        global $dsql,$type;
        $rl=array();
        $sql = "SELECT id,uid,username,dtime,reply,msg,agree,anti,pic,vote,ischeck FROM sea_comment WHERE m_type=$type AND id in ($ids) ORDER BY id DESC";
        $dsql->setQuery($sql);
        $dsql->Execute('commentrlist');
        while($row=$dsql->GetArray('commentrlist'))
        {
                $rl[]="\"".$row['id']."\":{\"uid\":".$row['uid'].",\"tmp\":\"\",\"nick\":\"".$row['username']."\",\"face\":\"\",\"star\":\"\",\"anony\":".(empty($row['username'])?1:0).",\"from\":\"".$row['username']."\",\"time\":\"".$row['dtime']."\",\"reply\":\"".$row['reply']."\",\"content\":\"".$row['msg']."\",\"agree\":".$row['agree'].",\"aginst\":".$row['anti'].",\"pic\":\"".$row['pic']."\",\"vote\":\"".$row['vote']."\",\"allow\":\"".(empty($row['anti'])?0:1)."\",\"check\":\"".$row['ischeck']."\"}";
        }
        $readrlist=join($rl,",");
        return $readrlist;
}

分析：

1. 未初始化的全局变量 $rlist 被外部控制

在函数中

$sqlCount = "SELECT count(*) as dd FROM sea_comment WHERE m_type=$type AND v_id=$id ORDER BY id DESC";

直接将 $type 和 $id 的值嵌入到查询中。如果 $type 或 $id 变量没有经过适当的验证或清理，可以通过修改这些参数来执行恶意的 SQL 查询，从而导致 SQL 注入攻击:

$sql = "SELECT id,uid,username,dtime,reply,msg,agree,anti,pic,vote,ischeck FROM sea_comment WHERE m_type=$type AND id in ($ids) ORDER BY id DESC";

Readrlist(ids) → id in (ids)

$ids 直接来自 $rlist 拼接的字符串。

而$rlist 中包含外部恶意构造的ID，这样就会导致SQL语法被篡改，进而能执行我们的注入查询。

通过报错注入就能尝试将管理员账户密码注入出来了。

flag：等沉下心来学习网安技术再补上注入过程

过程借鉴：SeaCMS V9海洋影视管理系统报错注入 - 技术栈

seacmsv9 SQL注入漏洞（报错注入）_seacmsv9联合注入查询-CSDN博客