VULHUB ™

漏洞文件：comments.php viewimg.php <? //comments include "mainfile.php"; $art=new article(); //设定 $confirm='yes';//yes:需要管理员认证后才能显示,no:直接显示 $member=new member(); $user_info=$member->member_auth(); $ulevel=$user_info[user_level]; ########设置############# $action = $_REQUEST[action]; $page="10";// $need_user = "0";// $id = $_REQUEST[id];// //对ID参数完全没过滤 $fdb = $PlusDB->prefix(forum);//评论的数据库 switch($action){ case "showNum": $sql="select count(*) as num from ".$fdb." where post_aid='$id'"; $showNum=$PlusDB->getone($sql); echo " function comment(id) { var page = \"".PLUS_URL."/comments.php?id=\" + id ; popwin = window.open(page,\"\",\"width=460,height=500,scrollbars,resizable\") popwin.focus(); } document.open(); document.write(\"<a href=\\\"javascript:comment('$id')\\\" title=\\\""._LANG_0930."\\\">"._LANG_0931." $showNum...

漏洞文件：comments.php viewimg.php &lt;? //comments include &quot;mainfile.php&quot;; $art=new article(); //设定 $confirm='yes';//yes:需要管理员认证后才能显示,no:直接显示 $member=new member(); $user_info=$member-&gt;member_auth(); $ulevel=$user_info[user_level]; ########设置############# $action = $_REQUEST[action]; $page=&quot;10&quot;;// $need_user = &quot;0&quot;;// $id = $_REQUEST[id];// //对ID参数完全没过滤 $fdb = $PlusDB-&gt;prefix(forum);//评论的数据库 switch($action){ case &quot;showNum&quot;: $sql=&quot;select count(*) as num from &quot;.$fdb.&quot; where post_aid='$id'&quot;; $showNum=$PlusDB-&gt;getone($sql); echo &quot; function comment(id) { var page = \&quot;&quot;.PLUS_URL.&quot;/comments.php?id=\&quot; + id ; popwin = window.open(page,\&quot;\&quot;,\&quot;width=460,height=500,scrollbars,resizable\&quot;) popwin.focus(); } document.open(); document.write(\&quot;&lt;a href=\\\&quot;javascript:comment('$id')\\\&quot; title=\\\&quot;&quot;._LANG_0930.&quot;\\\&quot;&gt;&quot;._LANG_0931.&quot; $showNum &quot;._LANG_0932.&quot;&lt;/a&gt;\&quot;); document.close();&quot;; break; case &quot;saveComment&quot;: &lt;? //image.php 显示附件的图片 include &quot;mainfile.php&quot;; $member=new member(); $confirm==false;//true 会员才能看,false 都能看 $user_info = $member-&gt;member_auth(); if($user_info[user_level]==&quot;Guest&quot; &amp;&amp; $confirm==true){ include &quot;modules/member/index.php&quot;; }else{ $imgdb = $PlusDB-&gt;prefix(images); $id=$_GET[id]; //米过滤,为什么他要直接获得啊! $aid = $_GET[aid]; //难道赶着吃晚饭? $sql=&quot;select id from $imgdb where aid=$aid order by id &quot;; Cmsez Web Content Manage System v2.0.0 <a href=http://www.cmsez.com/ target=_blank>http://www.cmsez.com/</a>