DIY-CMS blog mod SQL Injection 漏洞

SQL Injection:  
DORK:  
inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS"  
inurl:"mod.php?mod=blog"  

BUG:  
http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=tags&tag=features&start=[sqli]  
http://127.0.0.1/diy-cms/mod.php?mod=blog&start=[sqli]  
http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=[sqli]  
http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=8&year=[sqli]  
http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=list&catid=4&start=[sqli]  
http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=8&year=2&start=[sqli]  
http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=viewpost&blogid=26&start=[sqli]  

Why?:  
The variables $start, $year, $month are not filtered  
In file: /modules/blog/tags.php , list.php , index.php ,  
main_index.php , viewpost.php  
$start =(!isset($_GET['start'])) ? '0' : $_GET['start'];  

In file: /modules/blog/archive.php  
$start =(!isset($_GET['start'])) ? '0' : $_GET['start'];  
    $month =(!isset($_GET['month'])) ?  
error_msg($lang['ARCHIVE_NO_MONTH_SPECIFIED']) : $_GET['month'];  
    $year =(!isset($_GET['year'])) ?  
error_msg($lang['ARCHIVE_NO_YEAR_SPECIFIED']) : $_GET['year'];  

  In file: /modules/blog/control/approve_comments.php ,  
approve_posts.php , viewcat.php  
    $start =(!isset($_GET['start'])) ? '0' : $_GET['start'];  

本文由站长原创或收集,不代表本站立场,如若转载,请注明出处:http://www.yesck.com/post/495/

本文 暂无 评论

回复给

欢迎点评

联系我们

站长QQ:8117829

站长邮件:8117829@qq.com

工作时间:周一至周五,9:30-18:30,节假日休息

QR code