CVE:CVE-2009-1282
CNNVD:CNNVD-200904-213
glFusion是一个开源的内容管理系统。
glFusion的private/system/lib-session.php模块没有正确地过滤用户所提交的glf_session cookie参数，远程攻击者可以通过向服务器提交恶意请求执行SQL注入攻击。以下是/private/system/lib-session.php的97-117行的有漏洞代码段：
    ...
    if (isset ($_COOKIE[$_CONF[' cookie_session' ]])) {
    $sessid = COM_applyFilter ($_COOKIE[$_CONF[' cookie_session' ]]);
    if ($_SESS_VERBOSE) {
    COM_errorLog(" got $sessid as the session id from lib-sessions.php" ,1);
    }
    $userid = SESS_getUserIdFromSession($sessid, $_CONF[' session_cookie_timeout' ], $_SERVER[' REMOTE_ADDR' ], $_CONF[' cookie_ip' ]);  
    if ($_SESS_VERBOSE) {
    COM_errorLog(" Got $userid as User ID from the session ID" ,1);
    }
    if ($userid <  1) {
    // Check user status
    $status = SEC_checkUserStatus($userid);
    if (($status == USER_ACCOUNT_ACTIVE) ||
    ($status == USER_ACCOUNT_AWAITING_ACTIVATION)) {
    $user_logged_in = 1;
    SESS_updateSessionTime($sessid, $_CONF[' cookie_ip' ]);
在418-436行的SESS_updateSessionTime()函数中：
    ...
    function SESS_updateSessionTime($sessid, $md5_based=0) {
    global $_TABLES;
    $newtime = (string) time();
    if ($md5_based == 1) {
    $sql = " UPDATE {$_TABLES[' sessions' ]} SET start_time=$newtime WHERE (md5_sess_id = ' $sessid' )" ;  } else {
    $sql = " UPDATE {$_TABLES[' sessions' ]} SET start_time=$newtime WHERE (sess_id = $sessid)" ; //<-------- SQL INJECTION HERE  
    }
    $result = DB_query($sql);
    return 1;
    }
    ...
如果在通用配置中会话id不是md5()哈希(默认配置)，就可以注入SQL语句。
在SESS_getUserIdFromSession()函数的查询中：
    ...
    if ($md5_based == 1) {
    $sql = " SELECT uid FROM {$_TABLES[' sessions' ]} WHERE " 
    . " (md5_sess_id = ' $sessid' ) AND (start_time <  $mintime) AND (remote_ip = ' $remote_ip' )" ;  } else {
    $sql = " SELECT uid FROM {$_TABLES[' sessions' ]} WHERE " 
    . " (sess_id = ' $sessid' ) AND (start_time <  $mintime) AND (remote_ip = ' $remote_ip' )" ;  }
    ...
这个查询将所提供的sessid值与从会话表中的sessid值(整数)做了比较，而在比较时仅考虑了字符串的第一个整数值，因此函数返回了有效的userid。如果知道了表格中已有的sessid的话，就可以如下在cookie中注入查询：
  Cookie: glf_session=12345678 [SQL HERE]; glfusion=9999999999;
solution:Upgrade glfusion glfusion to a higher version than 1.1.2,1.0.0,1.0.0:rc1,1.0.0:rc2,1.0.1,1.1.0,1.1.0:rc1,1.1.1,and avoid the version (,1.1.2],1.0.0,1.0.0:rc1,1.0.0:rc2,1.0.1,1.1.0,1.1.0:rc1,1.1.1