yyladmin/yyladmin file list have SQL injection.md · 0kooo/cve_article

# Description of the vulnerability

yylAdmin is a simplified background management system based on ThinkPHP8 and Vue3, which only has basic functions such as login and logout, permission management, system management, interface documentation and debugging. front-end and back-end basic framework; You can build on this and develop extensions based on your business needs. Front and back separation, simple and lightweight, free and open source, out-of-the-box.

In this version, the interface /admin/file. There is an SQL injection vulnerability in file/list, which is caused by the application lacking validation of external input SQL statements, and an attacker can execute illegal SQL commands to obtain sensitive database data.

# System situation

## version

Before September 20, 2024

## Project address

[https://gitee.com/skyselang/yylAdmin](https://gitee.com/skyselang/yylAdmin)

## Affected parameters

is_disable

# analyse

1. First, find the interface function that is called

![输入图片说明](%E5%88%86%E6%9E%901.png)

You can see that the argument is obtained via `param`on line 55. After that, the `where` array is assigned on line 72.

2. Follow up with the `list` function

![输入图片说明](%E5%88%86%E6%9E%902.png)

You can see that at line 94, the `where` array is given to the `where()`function, and then the `count()`function is called

3. Continue to follow up with the `count()` function

![输入图片说明](%E5%88%86%E6%9E%903.png)

This function continues to call the `countWithGroup()` function and is right below. You can see that the `where` array is in the 'options' array

4. Continue to update the `buildSql()` function

![输入图片说明](%E5%88%86%E6%9E%904.png)

Continue to follow up with the select() function

![输入图片说明](%E5%88%86%E6%9E%905.png)

You can see that the data is finally spliced together here to form SQL statements

5. Go back to the `count()` function and continue to follow up with the `aggregate()`function

![输入图片说明](%E5%88%86%E6%9E%906.png)

继续跟进

![输入图片说明](%E5%88%86%E6%9E%907.png)

You can see that the resulting SQL statement is in the `query` array

6. Continue to follow up with the 'value()' function

![输入图片说明](%E5%88%86%E6%9E%908.png)

Finally, the SQL statement was executed on line 1255, resulting in an SQL injection vulnerability

# Repetition

I'm going to take the super administrator as an example, in fact, the user only needs to have access to the file management

1. First find the front-end interface

![输入图片说明](%E5%A4%8D%E7%8E%B01.png)

2. Find the packet in the burp and send it to the repeater module

![输入图片说明](%E5%A4%8D%E7%8E%B02.png)

3. Change the `is_disable` parameter to `1+union+select+sleep(3))+as+agc --` to reproduce

![输入图片说明](%E5%A4%8D%E7%8E%B03.png)

0kooo/cve_article

简介

发行版

贡献者

近期动态

0kooo/cve_article .gitee-modal { width: 500px !important; }

简介

发行版

贡献者

近期动态

搜索帮助

0kooo/cve_article