Two ECSHOP background SQL Injection Vulnerabilities (chicken ribs)

Admin/affiliate_ck.php

if ($_REQUEST['act'] == 'list'){    $logdb = get_affiliate_ck();    $smarty->assign('full_page',  1);    $smarty->assign('ur_here', $_LANG['affiliate_ck']);    $smarty->assign('on', $separate_on);function get_affiliate_ck(){    $affiliate = unserialize($GLOBALS['_CFG']['affiliate']);    empty($affiliate) && $affiliate = array();    $separate_by = $affiliate['config']['separate_by'];    $sqladd = '';    if (isset($_REQUEST['status']))    {        $sqladd = ' AND o.is_separate = ' . (int)$_REQUEST['status'];        $filter['status'] = (int)$_REQUEST['status'];    }    if (isset($_REQUEST['order_sn']))    {        $sqladd = ' AND o.order_sn LIKE \'%' . trim($_REQUEST['order_sn']) . '%\'';        $filter['order_sn'] = $_REQUEST['order_sn'];    }    if (isset($_GET['auid']))    {

 

Vulnerability 2: admin/agency. php

If ($ _ REQUEST ['ac'] = 'LIST') {$ smarty-> assign ('ur _ here ', $ _ LANG ['Agency _ list']); $ smarty-> assign ('Action _ link ', array ('text' => $ _ LANG ['add _ agency '], 'href' => 'Agency. php? Act = add'); $ smarty-> assign ('full _ page', 1); $ agency_list = get_agencylist (); $ smarty-> assign ('Agency _ list', $ agency_list ['Agency ']); $ smarty-> assign ('filter', $ agency_list ['filter']); $ smarty-> assign ('record _ count', $ agency_list ['record _ count']); $ smarty-> assign ('page _ count ', $ agency_list ['page _ count']); function get_agencylist () {$ result = get_filter (); if ($ result = false) {/* initialize the paging parameter */$ filt Er = array (); $ filter ['sort _ by'] = empty ($ _ REQUEST ['sort _ by'])? 'Agency _ id': trim ($ _ REQUEST ['sort _ by']); // can both be injected with $ filter ['sort _ order'] = empty ($ _ REQUEST ['sort _ order'])? 'Desc': trim ($ _ REQUEST ['sort _ order']);/* query the total number of records and calculate the number of pages */$ SQL = "SELECT COUNT (*) FROM ". $ GLOBALS ['ecs']-> table ('Agency '); $ filter ['record _ count'] = $ GLOBALS ['db']-> getOne ($ SQL); $ filter = page_and_size ($ filter ); /* query records */$ SQL = "SELECT * FROM ". $ GLOBALS ['ecs']-> table ('Agency '). "order by $ filter [sort_by] $ filter [sort_order]"; set_filter ($ filter, $ SQL);} else {$ SQL = $ result

 

Test method: 127.0.0.1/ec/admin/affiliate_ck.php? Act = list & auid = 1 'test method 127.0.0.1/ec/admin/agency. php? Act = list POST submit sort_by = 111111'