phpyun最新版两处注入(无视gpc)

- AV AC AU C I A
发布: 2025-04-13
修订: 2025-04-13

### 简要描述: PHP云人才系统 phpyun v4.0正式版 build20150819 4.0已经重新改版了,别在用3.2和4.0比较 ### 详细说明: 第一处出现在 /member/com/model/show.class.php中 3.2版本的源码是 ``` function delshow_action(){ $company_show=$this->obj->DB_select_all("company_show","`id` in (".$_POST['ids'].") and `uid`='".$this->uid."'","`picurl`"); if(is_array($company_show)&&$company_show){ foreach($company_show as $val){ $this->obj->unlink_pic(".".$val['picurl']); } $this->obj->DB_delete_all("company_show","`id` in (".$_POST['ids'].") and `uid`='".$this->uid."'",""); } return true; } ``` 以下是4.0的 ``` function delshow_action(){ $ids=$_POST['ids']; $company_show=$this->obj->DB_select_all("company_show","`id` in (".$ids.") and `uid`='".$this->uid."'","`picurl`"); if(is_array($company_show)&&$company_show){ foreach($company_show as $val){ unlink_pic(".".$val['picurl']); } $this->obj->DB_delete_all("company_show","`id` in (".$ids.") and `uid`='".$this->uid."'",""); $this->obj->member_log("删除企业环境展示"); } return true; ``` POST来的值直接带入查询,没有单引号,所以可以注入...

0%
暂无可用Exp或PoC
当前有0条受影响产品信息