任意文件上传

没有检测后缀直接上传jsp发现能够解析

@ResponseBody
@RequestMapping(value = "admin/uploadAdminHeadImage", method = RequestMethod.POST, produces = "application/json;charset=UTF-8")
public String uploadAdminHeadImage(@RequestParam MultipartFile file, HttpSession session) {
    String originalFileName = file.getOriginalFilename();
    logger.info("获取图片原始文件名：{}", originalFileName);
    assert originalFileName != null;
    String extension = originalFileName.substring(originalFileName.lastIndexOf('.'));
    //生成随机名
    String fileName = UUID.randomUUID() + extension;
    //获取上传路径
    String filePath = session.getServletContext().getRealPath("/") + "res/images/item/adminProfilePicture/" + fileName;

    logger.info("文件上传路径：{}", filePath);
    JSONObject jsonObject = new JSONObject();
    try {
        logger.info("文件上传中...");
        file.transferTo(new File(filePath));
        logger.info("文件上传成功！");
        jsonObject.put("success", true);
        jsonObject.put("fileName", fileName);
    } catch (IOException e) {
        logger.warn("文件上传失败！");
        e.printStackTrace();
        jsonObject.put("success", false);
    }
    return jsonObject.toJSONString();
}

以此为例所有文件上传接口都没做过滤均能任意文件上传

sql注入

在mybatis的xml配置文件中我们查询到了一个直接拼接的地方直接拼接orderUtil.orderBy这个函数名叫select

那么接下来就是查找orderUtil.orderBy 是否可控

查看哪里调用到了这个语句

我们找到了xml 映射的接口类UserMapper

查看哪里调用了UserMapper这个接口类

经过查找在UserServiceImpl类里面我们发现 UserMapper被依赖注入了

继续观察UserServiceImpl的函数内容发现getList函数调用了我们之前找到的select函数

我们寻找哪里调用了getList 函数

搜索userService.getList关键字

找到了一个位置

我们把这个位置完整的代码扒下来看看

@ResponseBody
    @RequestMapping(value = "admin/user/{index}/{count}", method = RequestMethod.GET, produces = "application/json;charset=UTF-8")
    public String getUserBySearch(@RequestParam(required = false) String user_name/* 用户名称 */,
                                  @RequestParam(required = false) Byte[] user_gender_array/* 用户性别数组 */,
                                  @RequestParam(required = false) String orderBy/* 排序字段 */,
                                  @RequestParam(required = false,defaultValue = "true") Boolean isDesc/* 是否倒序 */,
                                  @PathVariable Integer index/* 页数 */,
                                  @PathVariable Integer count/* 行数 */) throws UnsupportedEncodingException {
        //移除不必要条件
        Byte gender = null;
        if (user_gender_array != null && user_gender_array.length == 1) {
            gender = user_gender_array[0];
        }

        if (user_name != null) {
            //如果为非空字符串则解决中文乱码：URLDecoder.decode(String,"UTF-8");
            user_name = "".equals(user_name) ? null : URLDecoder.decode(user_name, "UTF-8");
        }
        if (orderBy != null && "".equals(orderBy)) {
            orderBy = null;
        }
        //封装查询条件
        User user = new User()
                .setUser_name(user_name)
                .setUser_gender(gender);

        OrderUtil orderUtil = null;
        if (orderBy != null) {
            logger.info("根据{}排序，是否倒序:{}",orderBy,isDesc);
            orderUtil = new OrderUtil(orderBy, isDesc);
        }

        JSONObject object = new JSONObject();
        logger.info("按条件获取第{}页的{}条用户", index + 1, count);
        PageUtil pageUtil = new PageUtil(index, count);
        List<User> userList = userService.getList(user, orderUtil, pageUtil);
        object.put("userList", JSONArray.parseArray(JSON.toJSONString(userList)));
        logger.info("按条件获取用户总数量");
        Integer userCount = userService.getTotal(user);
        object.put("userCount", userCount);
        logger.info("获取分页信息");
        pageUtil.setTotal(userCount);
        object.put("totalPage", pageUtil.getTotalPage());
        object.put("pageUtil", pageUtil);

        return object.toJSONString();
    }