微擎最新版SQL注入

2017-9-28 liyangweb.com 李杨 PHP


简介:

htmlspecialchars_decode 函数对全局过滤gpc产生的 \’ 进行转义,将可控的参数$html的污染值插入数据库后,产生SQL注入漏洞。

路径:

/网站根目录/web/source/site/editor.ctrl.php

披露时间: 

2017-06-02 08:19:47


阿里云给出的解决方案并不是修改此文件,而是修改/网站根目录/web/source/founder/display.ctrl.php


在第14行的如下代码后


$founders = explode(',', $_W['config']['setting']['founder']);

增加

$identity = uni_permission($_W['uid']);
if ($identity != ACCOUNT_MANAGE_NAME_FOUNDER && $identity != ACCOUNT_MANAGE_NAME_VICE_FOUNDER) {
    itoast('???????', referer(), 'error');
}

评论:

bcashed
2019-01-20 03:31
<a href="http://www.nhadatmoivn.com/nike-air-zoom-pegasus-33-buy-skou">nike air zoom pegasus 33 buy</a> <a href="http://www.cakirgozoto.com/mens-supra-vaider-purple-grey-shoesa">mens supra vaider purple grey</a> <a href="http://www.mozhizhou.com/where-can-i-get-a-kentucky-derby-hat-hatr">where can i get a kentucky derby hat</a> <a href="http://www.perialetheia.com/nike-air-free-dam%C3%A4nner-gr%C3%BCn-trainersa">nike air free dam盲nner gr眉n</a> <a href="http://www.honestmentor.com/nike-archive-75-menns-bl%C3%A5-skoe">nike archive 75 menns bl氓</a> <a href="http://www.edgethrive.com/orange-pink-womens-nike-air-max-2017.5-shoes-skoc">orange pink womens nike air max 2017.5 shoes</a>
bcashed http://www.bcashed.com/
byvestella
2019-01-06 13:42
<a href="http://www.bealfrance.com/nike-air-presto-flyknit-herren-multicolor-scarpea">nike air presto flyknit herren multicolor</a> <a href="http://www.brooklyngay.com/jordan-super-fly-2-gr%C3%B8nn-r%C3%B8d-schuheb">jordan super fly 2 gr酶nn r酶d</a> <a href="http://www.demointegrate.com/mennns-nike-shox-current-gull-svart-butyf">mennns nike shox current gull svart</a> <a href="http://www.diggingwp.com/air-jordan-jumpman-team-p%C3%BArpura-rosado-butyf">air jordan jumpman team p煤rpura rosado</a> <a href="http://www.frankiesvoice.com/air-jordan-4-retro-military-blu-2012-obuvf">air jordan 4 retro military blu 2012</a> <a href="http://www.hunnyblu.com/jordan-9-all-gull-obuve">jordan 9 all gull</a>
byvestella http://www.byvestella.com/
heximmag
2019-01-02 07:23
<a href="http://www.emunashipping.com/herren-air-jordan-9-schwarz-schuhef">herren air jordan 9 schwarz</a> <a href="http://www.freefna.com/nike-air-flight-huarache-prm-qs-nero-scarpee">nike air flight huarache prm qs nero</a> <a href="http://www.affiliaternd.com/nike-huarache-venditas-figures-kurpesa">nike huarache venditas figures</a> <a href="http://www.bebekhikayesi.com/nike-blazer-hi-vntg-nero-volt-kurpesc">nike blazer hi vntg nero volt</a> <a href="http://www.bladespares.com/nike-kobe-11-elite-nero-obuva">nike kobe 11 elite nero</a> <a href="http://www.cikotein.com/nike-kd-trey-5-orange-bl%C3%A5-schuhee">nike kd trey 5 orange bl氓</a>
[url=http://www.heximmag.com/]heximmag[/url]
ifshaildamage
2018-12-28 22:03
<a href="http://www.agichipay.com/nike-air-force-1-high-foamposite-red-black-skof">nike air force 1 high foamposite red black</a> <a href="http://www.millsbulb.com/kyrie-1-christmas-orange-skob">kyrie 1 christmas orange</a> <a href="http://www.hamshrd.com/kentucky-cap-hate">kentucky cap</a> <a href="http://www.lroyroofing.com/nike-air-max-one-dames-sale-runninge">nike air max one dames sale</a> <a href="http://www.golfbodyshop.com/adidas-zx-flux-viola-schuhea">adidas zx flux viola</a> <a href="http://www.yufnsyb.com/nike-mercurial-vapor-dark-gr%C3%B8n-inferno-scarpec">nike mercurial vapor dark gr酶n inferno</a>
ifshaildamage http://www.ifshaildamage.com/
laya
2018-05-26 18:30
我的也是漏洞显示还是未被修复
tom
2018-05-02 11:05
试了下,漏洞显示还是未被修复

发表评论:

Powered by emlog 冀ICP备13011830号-1