qibocms 下载系统SQL注入一枚

在download/s_rpc.php中
[php]

require(dirname(__FILE__).'/global.php');
header('Content-Type: text/html; charset=gb2312');
require_once(ROOT_PATH."inc/class.chinese.php");
$cnvert = new Chinese("UTF8","GB2312",$_POST['queryString'],ROOT_PATH."./inc/gbkcode/");
$_POST['queryString'] = $cnvert->ConvertIT();
$queryString = $_POST['queryString'];
if(strlen($queryString) >0) {
$query = $db->query("SELECT title FROM {$_pre}article WHERE title LIKE '$queryString' ORDER BY hits DESC LIMIT 10");
while ($result = $db->fetch_array($query)) {
echo '

  • '.$result[title].'
  • ';
    }
    }[/php]
    虽然全局转义 不过有
    [php]
    $cnvert = new Chinese("UTF8","GB2312",$_POST['queryString'],ROOT_PATH."./inc/gbkcode/");
    $_POST['queryString'] = $cnvert->ConvertIT();
    $queryString = $_POST['queryString'];
    [/php]
    这个 就可以来宽字节了。
    然后直接带入了查询 输出。
    本地测试
    qi
    测试下官网
    qi1

    发表评论