迅雷分站信息泄露多处ROOT权限SQL注入

$movieId = isset($_REQUEST['movie_id']) ? addslashes($_REQUEST['movie_id']) : NULL;
 
 $callback = isset($_REQUEST['callback']) ? $_REQUEST['callback'] : NULL;
 
 $userid = isset($_COOKIE['userid']) ? $_COOKIE['userid'] : NULL;
 
 clean_xss($callback);
 
 
 
 if( $userid ) {
 
  $config = require('config/config.php');
 
  if ( !$classify || !in_array($classify, $config['classify']) || !$movieId ) {
 
   $result['rtn'] = 1;
 
  }else{
 
   require('lib/DB.class.php');
 
   $db = new DB($config['dbase']['host'], $config['dbase']['userName'], $config['dbase']['password'], $config['dbase']['dbName'], 'latin1');
 
   
 
   $downSql = "SELECT title as name, download_link as url, filesize as size, resolution FROM IBO_{$classify}_download_info 
 
      WHERE id = {$movieId} and resolution between 0 and 4";
 
   
 
   $movieList = $db->getAll($downSql);
 
   if( count($movieList) > 0 ){
 
    $result['source'] = $movieList;
 
   }else{
 
    $result['rtn'] = 1;
 
   }
 
  }