【代码审计】某项目从前台SQL注入到后台GETSHELL

public functioncoachList(){  $input = $this->_param;  $shield_coach = $this->coach_model->getShieldCoach($this->getUserId());  if(!empty($input['service_time'])){    //    $working_coach = $this->coach_model->getWorkingCoach($this->_uniacid,$input['service_time']);    //    $cannot = CoachTimeList::getCannotCoach($this->_uniacid,$input['service_time']);    $working_coach = array_merge($working_coach,$cannot);    $shield_coach = array_merge($working_coach,$shield_coach);  }  if(!empty($input['cate_id'])){    $cate_model = new CateConnect();    $service_model = new ServiceCoach();    $id = $cate_model->where(['cate_id'=>$input['cate_id']])->column('service_id');    $coach_id = $service_model->where('ser_id','in',$id)->column('coach_id');    $dis[] = ['id','in',$coach_id];  }  $dis[] = ['id','not in',$shield_coach];  $dis[] = ['uniacid','=',$this->_uniacid];  $dis[] = ['status','=',2];  $dis[] = ['auth_status','=',2];  $dis[] = ['is_work','=',1];  if(!empty($input['coach_name'])){    $dis[] = ['coach_name','like','%'.$input['coach_name'].'%'];  }  if(!empty($input['city_id'])){    $dis[] = ['city_id','=',$input['city_id']];  }  if(isset($input['sex'])){    $dis[] = ['sex','=',$input['sex']];  }  if(!empty($input['work_time_start'])&&!empty($input['work_time_end'])){    $dis[] = ['work_time','between',"{$input['work_time_start']},{$input['work_time_end']}"];  }  $distance = !empty($input['distance'])?$input['distance']:100000;  $lat = !empty($input['lat'])?$input['lat']:0;  $lng = !empty($input['lng'])?$input['lng']:0;  $alh = 'ACOS(SIN(('.$lat.' * 3.1415) / 180 ) *SIN((lat * 3.1415) / 180 ) +COS(('.$lat.' * 3.1415) / 180 ) * COS((lat * 3.1415) / 180 ) *COS(('.$lng.' * 3.1415) / 180 - (lng * 3.1415) / 180 ) ) * 6378.137*1000 as distance';  $data = $this->coach_model->mapCoachList($dis,$alh,$distance);  return $this->success($data);}

public function mapCoachList($dis,$alh,$distance=100000){  $data = $this->where($dis)->field(['id,coach_name,work_img,lng,lat',$alh])->having("distance<$distance")->select()->toArray();  return $data;}

public function base64ToPngClouds(){  $input = $this->_input;  $data  = base64ToPngClouds($input['img'],$this->_uniacid,$this->_host);  if($data==false){    $this->errorMsg('生成图片失败');  }  return $this->success($data);}

if(!function_exists('base64ToPngClouds')){    functionbase64ToPngClouds($v,$uniacid,$host){        $host = 'https://'.$_SERVER['HTTP_HOST'];        if(!empty($v)){            $base_path = 'image/' . $uniacid . '/' . date('y') . '/' . date('m');            $path = FILE_UPLOAD_PATH.$base_path;            if(!file_exists($path)){                mkdir ($path,0777,true);            }            preg_match('/^(data:s*image/(w+);base64,)/', $v, $res);            if(strstr($v,",")){                $v = explode(',',$v);                $v = $v[1];            }            if(empty($res)){                return false;            }            $imageName = "/25220_".date("His",time())."_".rand(1111,9999).'.'.$res[2];            file_put_contents($path.$imageName, base64_decode($v));            $uploda_model = new appCommonUpload($uniacid);            $data = $uploda_model->uploadFile($base_path.$imageName,2);            if(empty($data['status'])||$data['status']!=1){                return false;            }            $info = $uploda_model->fileInfo($base_path.$imageName ,$imageName ,1);            $config = longbingGetOssConfig($uniacid);            if($data['longbing_driver']=='aliyun'&&!empty($config['aliyun_base_dir'])){                $info['attachment'] = $config['aliyun_base_dir']. '/' . $info['attachment'];            }            $info['attachment_path'] = longbingGetFilePath($info['attachment'] , $host,$uniacid ,$data['longbing_driver']);            return $info;        }        return [];    }}

Route::post('AdminSetting/xxxxx', 'AdminSetting/base64ToPngClouds');