Discuz! modcp/moderate.inc.php 数据库注射漏洞

ID SSV:4396
Type seebug
Reporter Root
Modified 2008-11-04T00:00:00



require_once DISCUZ_ROOT.'./include/discuzcode.func.php';
require_once DISCUZ_ROOT.'./include/attachment.func.php';

$ppp = 10;
$page = max(1, intval($page));
$start_limit = ($page - 1) * $ppp;

$modcount = $db->result_first("SELECT COUNT(*) FROM {$tablepre}posts WHERE invisible='$pstat' AND first='0' $fidadd[and]$fidadd[fids]");
$multipage = multi($modcount, $ppp, $page, "admincp.php?action=modreplies&filter=$filter&fid=$fid");

$fidadd在moderate.inc.php没有初始化也没有过滤直接在数据库里进行select操作,导致可以进行sql注射攻击. [这个文件访问需要斑主权限 :)] 0 2008-09 www.Discuz.net


Discuz! info: MySQL Query Error

User: admin
Time: 2008-11-3 10:51am
Script: /bbs/modcp.php

SQL: SELECT COUNT(*) FROM [Table]posts WHERE invisible='-2' AND first='0' 1
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1
Errno.: 1064