漏洞核心函数 \core\model_v5\trading\mdl.goods.php <code>public function getProducts( $gid, $pid = 0 ) { $sqlWhere = ""; if ( 0 < $pid ) { $sqlWhere = " AND A.product_id = ".$pid; //www.lpboke.com 没过滤 ~~~~~~ } $sql = "SELECT A.*,B.image_default FROM sdb_products AS A LEFT JOIN sdb_goods AS B ON A.goods_id=B.goods_id WHERE A.goods_id=".intval( $gid ).$sqlWhere; return $this->db->select( $sql ); }</code> \core\shop\controller\ctl.product.php 文件调用 <code>function gnotify($goods_id=0,$product_id=0){ if($_POST['goods']['goods_id']){ $goods_id = $_POST['goods']['goods_id']; $product_id = $_POST['goods']['product_id']; } $this->id =$goods_id; $objGoods = &$this->system->loadModel('trading/goods'); $aProduct = $objGoods->getProducts($goods_id, $product_id);//www.lpboke.com 直接带进去了 $this->pagedata['goods'] = $aProduct[0]; if($this->member[member_id]){ $objMember = &$this->system->loadModel('member/member');...
漏洞核心函数 \core\model_v5\trading\mdl.goods.php <code>public function getProducts( $gid, $pid = 0 ) { $sqlWhere = ""; if ( 0 < $pid ) { $sqlWhere = " AND A.product_id = ".$pid; //www.lpboke.com 没过滤 ~~~~~~ } $sql = "SELECT A.*,B.image_default FROM sdb_products AS A LEFT JOIN sdb_goods AS B ON A.goods_id=B.goods_id WHERE A.goods_id=".intval( $gid ).$sqlWhere; return $this->db->select( $sql ); }</code> \core\shop\controller\ctl.product.php 文件调用 <code>function gnotify($goods_id=0,$product_id=0){ if($_POST['goods']['goods_id']){ $goods_id = $_POST['goods']['goods_id']; $product_id = $_POST['goods']['product_id']; } $this->id =$goods_id; $objGoods = &$this->system->loadModel('trading/goods'); $aProduct = $objGoods->getProducts($goods_id, $product_id);//www.lpboke.com 直接带进去了 $this->pagedata['goods'] = $aProduct[0]; if($this->member[member_id]){ $objMember = &$this->system->loadModel('member/member'); $aMemInfo = $objMember->getFieldById($this->member[member_id], array('email')); $this->pagedata['member'] = $aMemInfo; } $this->output(); }</code> 漏洞核心函数 \core\model_v5\trading\mdl.goods.php <pre class="prettyprint linenums">public function getProducts( $gid, $pid = 0 ) { $sqlWhere = ""; if ( 0 < $pid ) { $sqlWhere = " AND A.product_id = ".$pid; //www.lpboke.com 没过滤 ~~~~~~ } $sql = "SELECT A.*,B.image_default FROM sdb_products AS A LEFT JOIN sdb_goods AS B ON A.goods_id=B.goods_id WHERE A.goods_id=".intval( $gid ).$sqlWhere; return $this->db->select( $sql ); }</pre> \core\shop\controller\ctl.product.php 文件调用 <pre class="prettyprint linenums">function gnotify($goods_id=0,$product_id=0){ if($_POST['goods']['goods_id']){ $goods_id = $_POST['goods']['goods_id']; $product_id = $_POST['goods']['product_id']; } $this->id =$goods_id; $objGoods = &$this->system->loadModel('trading/goods'); $aProduct = $objGoods->getProducts($goods_id, $product_id);//www.lpboke.com 直接带进去了 $this->pagedata['goods'] = $aProduct[0]; if($this->member[member_id]){ $objMember = &$this->system->loadModel('member/member'); $aMemInfo = $objMember->getFieldById($this->member[member_id], array('email')); $this->pagedata['member'] = $aMemInfo; } $this->output(); }</pre> SHOPEX 4.8.5 SHOPEX ---- 官方已经更新，请下载官方补丁 www.shopex.cn/
