帝国CMS(EmpireCMS)商品评分插件注入

90_

由于对参数的变量未作初始化检测导致 pf\rate.php 和 pf\ratemovie.php 中变量 $id 存在注入风险。

1. 
   
2. $id = $_GET['id'];
   
3. $query = "SELECT infopfen,infopfennum FROM phome_ecms_shop WHERE id=$id";
   
4. $result = mysql_query($query);
   
5. 
   
6. $v = $_GET['v'];
   
7. $id = $_GET['id'];
   
8. $query = "UPDATE phome_ecms_shop SET infopfen = infopfen + $v,infopfennum = infopfennum+1 WHERE id=$id";
   
9. $result = mysql_query($query);
   
10. $query = "SELECT infopfen,infopfennum FROM phome_ecms_shop WHERE id=$id";
    
11. $result = mysql_query($query);
    

复制代码

作者：Varsog

点评：其实是没单引号