Cutecms_v3.5 SQL injection and repair

/*************************************** * *************** // * Cutecms_v3.5 SQL Injection Vulnerability/* ================ ===========/*:: Kn1f3/* E-Mail: 681796@qq.com /************************************** * **************** // * Welcome http://www.90sec.com *//************************************* * *****************/First, check the index of the home page file. php >>>>/**/unrelated code omitting/**/define ('in _ CUTECMS ', true); if (! File_exists ("include/install. lock ") {header (" location: install/"); exit;} require_once ('include/helper. php '); require_once ('include/generate_static.inc.php '); // include file >>>>/**/omit irrelevant code/**/if ($ staticUrl & $ staticUrl! = 'Index') {if (preg_match ("/^ (. *) _ page ([0-9] {1,}) $/I ", $ staticUrl) {$ url = substr ($ staticUrl, 0, strpos ($ staticUrl, "_ page ")). ". html "; $ staticUrlRow = getStaticUrlRow ($ db, $ url); $ action = $ staticUrlRow ['action']; $ urlChannelId = $ urlContentId = $ staticUrlRow ['rid']; $ urlPageNum = substr ($ staticUrl, strpos ($ staticUrl, "_ page") + 5);} else {$ url = $ staticUrl. ". html "; $ staticUrlRow = getStaticUrlRo W ($ db, $ url); // you can check the getStaticUrlRow function if (! $ StaticUrlRow) {$ pathPartsArr = pathinfo ($ url); $ staticPathArr = explode ("/", $ pathPartsArr ['dirname']); $ staticChannelHtmlName = array_pop ($ staticPathArr); >>>>/**/unrelated Code omitted/** // follow helper. phprequire_once (BASE. "lang. inc. php "); require_once (BASE. "base. inc. php "); require_once (BASE. "validate. inc. php "); require_once (BASE. "elements. inc. php "); require_once (BASE. "template. inc. php "); // continue with the base. inc. phpfu Nction getStaticUrlRow ($ db, $ url = "", $ rid = "") {$ SQL = "SELECT * FROM ". PREFIX. "static_url WHERE 1"; if ($ url) // the query is not filtered. {$ SQL. = "AND url = '". $ url. "'";} if ($ rid) {$ SQL. = "AND rid = ". $ rid;} $ SQL. = "LIMIT 1"; $ re = $ db-> getRow ($ SQL); return $ re;} // if the file is encrypted, can the vulnerability be fixed? Author too 2>/**/irrelevant Code omitted /**/ http://127.0.0.1/cutecms_free_v3.5/index.php?staticUrl= [SQL]

 

Solution:

:) The anti-injection code of 80sec can be used.