Hotelphpweb SQL injection

A hotel system under phpweb.
News/html/index. php
 
 
Hotelphpweb SQL injection
// Define the module name and Page name
PageSet ("news", "detail ");
 
Trace the PageSet function.
 
 
Hotelphpweb SQL injection
Function pageset ($ coltype, $ pagename)
{
Global $ GLOBALS ['msql'];
$ Msql-> query ("select * from {P} _ base_pageset where coltype = '{$ coltype}' and pagename = '{$ pagename }'");
//... Omitting line N of code
 
 
Variable $ coltype, $ pagename is directly substituted into the query () method without any Filtering
Trace query () www.2cto.com
 
 
Hotelphpweb SQL injection
Function query ($ Query_String)
{
$ Query_String = str_replace ("{P}", $ this-> TablePre, $ Query_String );
$ This-> connect ();
$ This-> Query_ID = mysql_query ($ Query_String, $ this-> Link_ID );
$ This-> Row = 0;
$ This-> Errno = mysql_errno ();
$ This-> Error = mysql_error ();
If (! $ This-> Query_ID)
{
$ This-> halt ("Invalid SQL:". $ Query_String );
}
Return $ this-> Query_ID;
}
 
 
 
 
The variable $ Query_String is directly substituted into the query.
 
EXP: http://www.bkjia.com/news/html /? 384 '/**/and/**/1 = 1/**/and/**/'your '.html
 
The upload program of this program. The file name saved to the server is obtained using $ _ POST ['filename. This is also controllable.
 
 
From sentiment 'blog!