Casual dog deletes any guest speaker

And then an unauthorized Delete .. I guess I will not find it for you. You can find it by yourself. File modules/ajax/item. mod. php 133

Function Del () {$ id = (int) $ this-> Post ['id']; if ($ id> 0) {DB :: query ("delete from '". DB: table ('item _ user '). "'where iid = '$ id '");}}

 

Any records in the item_user table can be deleted as long as you are logged on (this table keeps the guest) like this address http://t.jishigou.net/ajax.php? Mod = item & code = del post id = xx. You can del it. The test accidentally deleted two. Sorry. Solution: Permission check .. There should be a lot of unauthenticated places.