当前位置:首页 >> 网络通讯 >> 网络安全 >> 内容

Stcms sql注射及修复

时间:2015/5/19 18:57:27 作者:平凡之路 来源:xuhantao.com 浏览:

任意sql语句执行

case 'list':
      
              $totalNum = $mysql->numTable("member", $where);
              $pageNum = 20;
              $totalPage = intval($totalNum/$pageNum) == $totalNum/$pageNum ? $totalNum/$pageNum : intval($totalNum/$pageNum)+1;
              $page = $page ? $page : 1;
              $page = $page>$totalPage ? $totalPage : $page;
              $page = $page<1 ? 1 : $page;
              $members = $mysql->select("member","id,name,time,money,provience,city,picture",$where,array("id DESC"),array(($page-1)*$pageNum,$pageNum));
              require(INCLUDE_PATH."page.class.php");
              $pageClass = new page($page,$totalNum,$pageNum, WEB_URL."member/u.php?action=list", true);
              $pageCode = $pageClass->getCode();
              $smarty->assign("webTitle","会员列表");
              $smarty->assign("uList", $members);
              $smarty->assign("pageCode", $pageCode);
              $smarty->display("member/m_u_list.html");
 
function numTable($table='',$wheres=false)
       {
              $table = $this->dbPrefix.$table;
              $sql = "SELECT COUNT(*) AS num FROM `$table`";
              if($wheres)
              {
                     $sql .= " WHERE ";
                     if(is_array($wheres))
                     {
                            foreach($wheres as $key => $val)
                            {
                                   $whr[] = "`$key`='".$val."'";
                            }
                            $sql .= implode(" AND ",$whr);
                     }
                     elseif(is_string($wheres))
                     {
                            $sql .= $wheres;
                     }
              }
              $result = $this->fetch($this->query($sql));
              return $result['num'];
       }
Where 没初始化 导致可执行任意sql语句

测试:
/stcms_html/member/u.php?action=list&where={sql}
修复方案:你懂的吧 ,www.xuhantao.com,涛涛电脑知识

相关文章
  • 没有相关文章
共有评论 0相关评论
发表我的评论
  • 大名:
  • 内容:
  • 徐汉涛(www.xuhantao.com) © 2021 版权所有 All Rights Reserved.
  • 部分内容来自网络,如有侵权请联系站长尽快处理 站长QQ:965898558(广告及站内业务受理) 网站备案号:蒙ICP备15000590号-1