Fanwe navigation SQL Injection Vulnerability Analysis

When I opened it, I found that my number was blacklisted. The speed returned to the post. I was nervous. I found a system for the speed. Okay, I admit that I just read it, the array is not filtered and directly submitted to the query statement. The vulnerability is found in userModule. class. PHP File

 

Paste the code.

Public function stepsave () {if (intval ($ GLOBALS ['user _ info'] ['id']) = 0) {es_session :: set ('before _ login', $ _ SERVER ['request _ URI ']); app_redirect (url ("shop", "user # login "));} $ user_id = intval ($ GLOBALS ['user _ info'] ['id']); $ focus_list = explode (",", $ _ REQUEST ['user _ id']); // dangerous. Foreach ($ focus_list as $ k => $ focus_uid) {// echo $ focus_uid; // exit; if (intval ($ focus_uid)> 0) {// only detected... $ Focus_data = $ GLOBALS ['db']-> getRow ("select * from ". DB_PREFIX. "user_focus where focus_user_id = ". $ user_id. "and focused_user_id = ". intval ($ focus_uid); if (! $ Focus_data) {$ focused_user_name = $ GLOBALS ['db']-> getOne ("select user_name from ". DB_PREFIX. "user where id = ". $ focus_uid); // comes in. $ Focus_data = array (); $ focus_data ['focus _ user_id '] = $ user_id; $ focus_data ['focused _ user_id'] = $ focus_uid; $ focus_data ['focus _ user_name '] = $ GLOBALS ['user _ info'] ['user _ name']; $ focus_data ['focused _ user_name'] = $ focused_user_name; $ GLOBALS ['db']-> autoExecute (DB_PREFIX. "user_focus", $ focus_data, "INSERT"); $ GLOBALS ['db']-> query ("update ". DB_PREFIX. "user set focus_count = focus_count + 1 where id = ". $ user_id); $ GLOBALS ['db']-> query ("update ". DB_PREFIX. "user set focused_count = focused_count + 1 where id = ". $ focus_uid) ;}}showsuccess ($ GLOBALS ['lang '] ['register _ SUCCESS'], 0, url ("shop", "uc_center "));}

As you can see, intval has been detected. The result is, bring it directly, and I will not talk about anything., try to get scared. I'm leaving!
 
Exp is very simple, so I will not write it. It's an international issue.