### 简要描述： 过滤不严。 ### 详细说明： 虽然有全局转义 但是在plugins/gov.order/order.php中 ``` function m__save_order(){ global $dbm; //判断登陆 if(!isset($_SESSION['uid']) || !isset($_SESSION['uname'])) die('{"code":"100","msg":"你还没有登陆，请登入后再购买"}'); $info_id = $_POST['info_id']; $info_title = urldecode($_POST['info_title']); $price = isset($_POST['price'])?$_POST['price']:0; $number = isset($_POST['number'])?$_POST['number']:0; if(!is_numeric($price)) die('{"code":"100","msg":"价格必须是数字"}'); if(!is_numeric($number)) die('{"code":"100","msg":"数量必须是数字"}'); if(intval($price)<=0) die('{"code":"120","msg":"购买数量不能少于1"}'); if(strlen($_POST['rev_user'])<2) die('{"code":"100","msg":"收货人姓名必须填写"}'); if(strlen($_POST['rev_addr'])<6) die('{"code":"100","msg":"收货人地址必须填写"}'); if(strlen($_POST['rev_phone'])<8) die('{"code":"100","msg":"收货人手机必须填写"}'); $params['order_content'] = ''; $params['pay_total'] = 0; $params['order_content'] .= $price."元 x ".$number.""; $params['pay_total'] += $number*$price; //订单数据 $params['uid'] =...
### 简要描述： 过滤不严。 ### 详细说明： 虽然有全局转义 但是在plugins/gov.order/order.php中 ``` function m__save_order(){ global $dbm; //判断登陆 if(!isset($_SESSION['uid']) || !isset($_SESSION['uname'])) die('{"code":"100","msg":"你还没有登陆，请登入后再购买"}'); $info_id = $_POST['info_id']; $info_title = urldecode($_POST['info_title']); $price = isset($_POST['price'])?$_POST['price']:0; $number = isset($_POST['number'])?$_POST['number']:0; if(!is_numeric($price)) die('{"code":"100","msg":"价格必须是数字"}'); if(!is_numeric($number)) die('{"code":"100","msg":"数量必须是数字"}'); if(intval($price)<=0) die('{"code":"120","msg":"购买数量不能少于1"}'); if(strlen($_POST['rev_user'])<2) die('{"code":"100","msg":"收货人姓名必须填写"}'); if(strlen($_POST['rev_addr'])<6) die('{"code":"100","msg":"收货人地址必须填写"}'); if(strlen($_POST['rev_phone'])<8) die('{"code":"100","msg":"收货人手机必须填写"}'); $params['order_content'] = ''; $params['pay_total'] = 0; $params['order_content'] .= $price."元 x ".$number.""; $params['pay_total'] += $number*$price; //订单数据 $params['uid'] = isset($_SESSION['uid']) ? $_SESSION['uid'] : 0; $params['uname'] = isset($_SESSION['uname']) ? $_SESSION['uname'] : ''; $params['info_title'] = $info_title; $params['info_id'] = $info_id; $params['order_receive'] = preg_replace('~<[^>]*>~','','收货人：'.$_POST['rev_user'].chr(10).'手机：'.$_POST['rev_phone'].chr(10).'收货地址：'.$_POST['rev_addr']); $params['create_time'] = time();//die(print_r($params)); //入库 if(isset($_SESSION['postdata']['gov_order']) && (time()-$_SESSION['postdata']['gov_order']<30)) die('{"code":"101","msg":"请不要重复提交订单"}'); $res = $dbm->single_insert(TB_PREFIX."order",$params); ``` 可以看到 info_title 是解码来的 所以就无视了全局的转义。、 然后带入了 ``` public function single_insert($table_name, $fields, $type = 0) { if (!is_array($fields) || count($fields) == 0) return array('sql' => '', 'error' => '插入失败，插入字段为空', 'sql_time' => 0, 'autoid' => 0); $sql_field = ""; $sql_value = ""; // 遍历字段和值 foreach($fields as $key => $value) { $sql_field .= ",$key"; $sql_value .= ",'$value'"; } $sql_field = substr($sql_field, 1); $sql_value = substr($sql_value, 1); if ($type == 0) { $sql = "insert ignore into $table_name ($sql_field) values ($sql_value)"; //组合SQL } else { $sql = "replace into $table_name ($sql_field) values ($sql_value)"; //组合SQL } echo $sql; exit; $result = $this -> query_insert($sql); ``` 组合语句 这里 我直接把语句输出来 ### 漏洞证明： [<img src="https://images.seebug.org/upload/201404/12212241ce7cb8fc4f9008910c310018c4596471.jpg" alt="m1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201404/12212241ce7cb8fc4f9008910c310018c4596471.jpg) [<img src="https://images.seebug.org/upload/201404/122123020e71ec54bd2b11863ff4ca1164b9b96a.jpg" alt="M2.Jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201404/122123020e71ec54bd2b11863ff4ca1164b9b96a.jpg) 相等即延时。
