zzcms user/logincheck.php SQL注入漏洞 CNVD-2016-12088
inc/function.php 72行 ```php function getip(){ if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown")) $ip = getenv("HTTP_CLIENT_IP"); else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown")) $ip = getenv("HTTP_X_FORWARDED_FOR"); else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown")) $ip = getenv("REMOTE_ADDR"); else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown")) $ip = $_SERVER['REMOTE_ADDR']; else $ip = "unknown"; return($ip); } ``` 继续看 `user/logincheck.php` 第19行 ```php $ip=getip(); define('trytimes',5);//可尝试登录次数 define('jgsj',10*60);//间隔时间，秒 $sql="select * from zzcms_login_times where ip='$ip' and count>=".trytimes." and unix_timestamp()-unix_timestamp(sendtime)<".jgsj." "; $rs = query($sql); $row= num_rows($rs); if ($row){ ``` ip没有任何过滤 直接进入sql语句查询 导致 sql注入漏洞
