Dedecms injection vulnerability administrator password

When a file in Dedecms is not filtered and directly inserted into SQL queries, attackers can inject SQL code to bypass sqlids detection and execute SQL statements when magic_quotes_gpc = off.
For details, the member center and registered user logon are required. magic_quotes_gpc = off, and php version requirements are not harmful.
The vulnerability code is as follows:
 
Root @ bt:/var/www/dede/member # cat-n edit_face.php
 
9 require_once (dirname (_ FILE _). "/config. php"); // contains the harmonious ../include/filter. inc. php
10 CheckRank (); // check permissions. At least if an authenticated member is used, what cannot be registered? Don't worry. We have a solution.
11 $ menutype = 'config ';
12 if (! Isset ($ dopost ))
13 {
14 $ dopost = ";
15}
16 if (! Isset ($ backurl ))
17 {
18 $ backurl = 'edit _ face. php ';
19}
20 if ($ dopost = 'save ')
21 {
22 $ maxlength = $ cfg_max_face * 1024;
23 $ userdir = $ pai_user_dir. '/'. $ pai_ml-> M_ID;
24 if (! Preg_match ("# ^". $ userdir. "#", $ oldface) // This regular expression can be bypassed to continue playing
25 {
26 $ oldface = ";
27}
28 if (is_uploaded_file ($ face ))
29 {
30 if (@ filesize ($ _ FILES ['face'] ['tmp _ name'])> $ maxlength)
31 {
32 ShowMsg ("the size of your uploaded Avatar file exceeds the system limit: {$ pai_max_face} K! ", '-1 ′);
33 exit ();
 
34}
35 // Delete the old image (to prevent different file extensions, for example, the original image is gif and later the image is jpg)
36 if (preg_match ("# \. (jpg | gif | png) $ # I", $ oldface) & file_exists ($ pai_basedir. $ oldface ))
37 {
38 @ unlink ($ pai_basedir. $ oldface );
39}
40 // upload a new job image www.2cto.com
 
41 $ face = MemberUploads ('face', $ oldface, $ pai_ml-> M_ID, 'image', 'myface', 180,180 );
42}
43 else
44 {
45 $ face = $ oldface; // $ oldface is a variable that we can control.
46}
47 $ query = "UPDATE 'dede _ member' SET 'face' = '$ face' WHERE mid =' {$ pai_ml-> M_ID} '"; // injection vulnerability caused here
48 $ dsql-> ExecuteNoneQuery ($ query );
49 // clear Cache
50 $ pai_ml-> DelCache ($ pai_ml-> M_ID );
51 ShowMsg ('the profile information is successfully updated! ', $ Backurl );
52 exit ();
53}

 
Author c4rp3nt3r