Home > Backend Development > PHP Tutorial > phpcms2008破绽

phpcms2008破绽

WBOY
Release: 2016-06-13 10:40:13
Original
817 people have browsed it

phpcms2008漏洞

下面是官方到目前为止还没有打补丁的几个漏洞

http://www.tmdsb.com/flash_upload.php?modelid=1

注入漏洞

<?phprequire dirname(__FILE__).'/include/common.inc.php';if($PHPSESSID) {	session_id($PHPSESSID);	session_start();}if($auth) set_cookie('auth', $auth);if(!get_cookie('cookietime') && $cookietime) set_cookie('cookietime', $cookietime);require_once 'admin/model_field.class.php';<span style="color: #ff0000;">$field = new model_field($modelid);$info = $field->get($fieldid);
Copy after login

?

问题就出在标红的。。跟进去看下

    function __construct($modelid)    {		global $db;		$this->db = &$db;		$this->table = DB_PRE.'model_field';		echo($modelid);		<span style="color: #ff0000;">$model = $this->db->get_one("SELECT * FROM ".DB_PRE."model WHERE modelid=$modelid");</span>		$this->modelid = $model['modelid'];		$this->modelname = $model['name'];		$this->fields =  cache_read($modelid.'_fields.inc.php', CACHE_MODEL_PATH);		$this->tablename = DB_PRE.'c_'.$model['tablename'];    }
Copy after login

?

构造方法中调用了select...所以忘了过滤。。。

Related labels:
source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template