TCCMS在app/controller/news.class.php存在sql注入漏洞

漏洞成因 在app/controller/news.class.php中all函数对参数过滤不严 public function all $this-userIsLogin ; $Obj = M$this-objName; $categoryObj = M"category"; $Obj-pageSize = 20; $where = "1=1"; $key = StringUtil::GetSQLValueString$POST'key'; $cid = intval$GET'cid'; if $key != "" $where .= " and title like...