A function of phpyun does not strictly process parameters, resulting in SQL injection.

Phpyun personal member center member/model/index. class. php $ _ COOKIE ["usertype"]; The parameter is injected. The following Code shows that $ data ["usertype"] directly reads the COOKIE value and brings it into SQL, SQL does not filter the value

Function msg_action () {if ($ _ GET ["del"]) {$ nid = $ this-> obj-> DB_delete_all ("userid_msg ", "'id' = '". $ _ GET ["del"]. "'and 'uid' = '". $ this-> uid. "'"); isset ($ nid )? $ This-> obj-> ACT_msg ("index. php? C = msg "," deleted successfully "): $ this-> obj-> ACT_msg (" index. php? C = msg "," failed to delete ") ;}$ this-> public_action (); $ urlarr = array (" C "=>" msg ", "page" => "{page}"); $ pageurl = $ this-> url ("index", "index", $ urlarr ); $ this-> get_page ("userid_msg", "'uid' = '". $ this-> uid. "'and type! = '1' order by id desc ", $ pageurl," 20 "); if ($ _ GET [" c_uid "]) {$ data ["c_uid"] = $ _ GET ["c_uid"]; $ data ["inputtime"] = mktime (); $ data ["p_uid"] = $ _ COOKIE ["uid"]; $ data ["usertype"] = $ _ COOKIE ["usertype"]; $ data ["com_name"] = $ _ GET ["c_name"]; $ haves = $ this-> obj-> DB_select_once ("blacklist ", "'P _ uid' = ". $ data ["p_uid"]. "and 'C _ uid' = ". $ data ["c_uid"]. "and 'usertype' = ". $ data ["usertype"]. ""); if (is_array ($ haves) {$ this-> obj-> ACT_m Sg ($ _ SERVER ['HTTP _ referer'], "This user is already in your blacklist ");} else {$ nid = $ this-> obj-> insert_into ("blacklist", $ data); $ this-> obj-> DB_delete_all ("userid_msg ", "'uid' = ". $ data ["p_uid"]. "and 'fid' = ". $ data ["c_uid"]. "", ""); $ nid? $ This-> obj-> ACT_msg ($ _ SERVER ['HTTP _ referer'], "Operation successful "): $ this-> obj-> ACT_msg ($ _ SERVER ['HTTP _ referer'], "operation failed") ;}} function DB_select_once ($ tablename, $ where = 1, $ select = "*") {$ cachename = $ tablename. $ where; if (! $ Return = $ this-> Memcache_set ($ cachename) {$ SQL = "SELECT ". $ select. "FROM ". $ this-> def. $ tablename. "WHERE ". $ where. "limit 1"; echo $ SQL; $ query = $ this-> db-> query ($ SQL ); $ return = $ this-> db-> fetch_array ($ query); $ this-> Memcache_set ($ cachename, $ return);} return $ return ;}