Espcms V5.6.13.04.22 official UTF8 injection vulnerability 1/N

Espcms V5.6.13.04.22 an injection vulnerability exists in an official UTF8 file, allowing you to obtain the Administrator account and password.
 
Vulnerability file: \ interface \ membermain. php

$ Zipcode = trim ($ this-> fun-> accept ('zipcode', 'P', true, true )); // row 185th $ zipcode = empty ($ zipcode )? 0: $ zipcode ;...... $ db_where = "userid = $ this-> ec_member_username_id AND username = '$ this-> ec_member_username'"; $ db_set = "sex = $ sex, birthday = $ birthday, country = $ country, province = $ province, city = $ city, district = $ district, alias = '$ alias', address =' $ address', zipcode = $ zipcode, tel = '$ tel', mobile =' $ mobile', qq = $ qq, msn = '$ msn' "; $ this-> db-> query ('update '. $ db_table. 'set '. $ db_set. 'where '. $ db_where );

$ Zipcode variables are not included in single quotes, resulting in an SQL injection vulnerability.

In the update statement, in addition to getting the Administrator account password through injection, you can also modify the information of any member, including the password.

The entered SQL statement is as follows:

Die ('update'. $ db_table. 'set'. $ db_set. 'where'. $ db_where)




 

Update the administrator password to the email information.




Solution:

Put variables in single quotes