54.代码审计-TP5框架审计写法分析及代码追踪

代码审计-TP5框架审计写法分析及代码追踪

QQ截图20220406100108.jpg

QQ截图20220413090837.jpg

ThinkPHP历史漏洞https://github.com/Mochazz/ThinkPHP-Vuln

ThinkPHP5.0.15注入漏洞

https://github.com/Mochazz/ThinkPHP-Vuln/blob/master/ThinkPHP5/ThinkPHP5%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E4%B9%8BSQL%E6%B3%A8%E5%85%A51.md

根据提供的信息设置靶场

#获取代码
composer create-project --prefer-dist topthink/think=5.0.15 tpdemo

#设置版本信息并更新
#composer.json
"require": {
    "php": ">=5.4.0",
    "topthink/framework": "5.0.15"
}

#获取代码
composer update

#修改为测试代码
#application/index/controller/Index.php

<?php
namespace app\index\controller;

class Index
{
    public function index()
    {
        $username = request()->get('username/a');
        db('users')->insert(['username' => $username]);
        return 'Update success';
    }
}

#数据库语句
create database tpdemo;
use tpdemo;
create table users(
    id int primary key auto_increment,
    username varchar(50) not null
);