PHP cloud talent system SQL Injection

PHP cloud talent system SQL Injection

 

PHP cloud talent system enterprise user registration page Code Conversion caused by SQL injection:

http://www.hr135.com/index.php?m=register&usertype=2

Company Name: Taobao Company address:, address = injected SQL, used here, address = concat (user (), 0x0a, version ())#

For example:
 

Click register now. After successful registration, the "Enterprise Information page" is displayed. The data is displayed in "company address", for example:
 

The corresponding code is:

Model/register. class. php 63 function regsave_action () {64 $ _ POST = $ this-> post_trim ($ _ POST); 65 $ _ POST ['username'] = iconv ("UTF-8 ", "gbk", $ _ POST ['username']); 66 $ _ POST ['unit _ name'] = iconv ("UTF-8", "gbk ", $ _ POST ['unit _ name']); // The input 'handler' is converted here, '\' 67 $ _ POST ['address'] = iconv ("UTF-8", "gbk", $ _ POST ['address']) is introduced; 68 if (trim ($ _ POST ['Password']) & trim ($ _ POST ['Password'])! = Trim ($ _ POST ['passconfirm']) {69 echo "8 ##?????????????? Why? "; Die; 70} 71 if (! $ This-> CheckRegUser ($ _ POST ['username']) {72 echo "8 ##?????????????????? "; Die; 73} 74 if (! $ This-> CheckRegEmail ($ _ POST ['email ']) {75 echo "8 ## email ?????? Why ?? "; Die; 76} 77 if ($ _ COOKIE ['uid']! = "" & $ _ COOKIE ['username']! = "") {78 echo "8 ##??????????? "; Die; 79} 80 $ usertype =$ _ POST ['usertype']; 81 if (strstr ($ this-> config ['Code _ web'], '?????? ') {82 if (md5 ($ _ POST ['authcode'])! = $ _ SESSION ['authcode']) {83 echo "8 ##??????????? "; Die; 84} 85} 86 if ($ _ POST ['username']! = "") {87 $ nid = $ this-> obj-> DB_select_once ("member", "'username' = '". $ _ POST ['username']. "'or 'email' = '". $ _ POST ['email ']. "'"); 88 if (is_array ($ nid) {89 echo "8 ##????????????????? "; Die; 90} 91 if ($ _ POST ['usertype'] = '2') {92 if ($ this-> config ['com _ enforce_mobilecert ']! = '1') {93 unset ($ _ POST ['moblil']); 94} 95 96 $ satus = $ this-> config ['com _ status']; 97} 98 if ($ this-> config ['sy _ uc_type '] = "uc_center") {99 $ this-> obj-> uc_open (); 100 $ uid = uc_user_register ($ _ POST ['username'], $ _ POST ['Password'], $ _ POST ['email ']); 101 if ($ uid <= 0) {102 echo "8 ##???????????? "; Die; 103} else {104 list ($ uid, $ username, $ password, $ email, $ salt) = uc_user_login ($ _ POST ['username'], $ _ POST ['Password']); 105 $ pass = md5 (md5 ($ _ POST ['Password']). $ salt); 106 $ ucsynlogin = uc_user_synlogin ($ uid); 107} 108} elseif ($ this-> config ['sy _ pw_type '] = "pw_center ") {109 include (APP_PATH. "/api/pw_api/pw_client_class_phpapp.php"); 110 $ username = $ username; 111 $ password =$ _ POST ['Password']; 112 $ emai L =$ _ POST ['email ']; 113 $ pw = new PwClientAPI ($ username, $ password, $ email); 114 $ pwuid = $ pw-> register (); 115 $ salt = substr (uniqid (rand (),-6); 116 $ pass = md5 ($ password ). $ salt); 117} else {118 $ salt = substr (uniqid (rand (),-6 ); 119 $ pass = md5 (md5 ($ _ POST ['Password']). $ salt); 120} 121 $ ip = $ this-> obj-> fun_ip_get (); 122 $ data ['username'] = $ _ POST ['username']; 123 $ data ['Password'] = $ pass; 124 $ data ['Moblil'] = $ _ POST ['moblil']; 125 $ data ['email '] = $ _ POST ['email']; 126 $ data ['usertype'] = $ _ POST ['usertype']; 127 $ data ['status'] = $ satus; 128 $ data ['salt'] = $ salt; 129 $ data ['reg _ date'] = time (); 130 $ data ['reg _ ip'] = $ ip; 131 $ data ['qqid'] = $ _ SESSION ['qq'] ['openid']; 132 $ data ['sinaid '] =_ _ SESSION ['sinaid']; 133 $ userid = $ this-> obj-> insert_into ("member", $ data ); 134 if (! $ Userid) {135 $ user_id = $ this-> obj-> DB_select_once ("member", "'username' = '". $ _ POST ['username']. "'", "'uid'"); 136 $ userid = $ user_id ['uid']; 137} 138 if ($ userid) {139 $ this-> unset_cookie (); 140 if ($ this-> config [sy_pw_type] = "pw_center ") {141 $ this-> obj-> DB_update_all ("member", "'pwuid' = '". $ pwuid. "'", "'uid' = '". $ userid. "'"); 142} 143 if ($ _ POST ['usertype'] = "1") {144 $ table = "member_statis"; 145 $ tab Le2 = "resume"; 146 $ value = "'uid' = '". $ userid. "'"; 147 $ value2 = "'uid' = '". $ userid. "', 'email' = '". $ _ POST ['email ']. "', 'telphone' = '". $ _ POST ['moblil']. "'"; 148} elseif ($ _ POST ['usertype'] = "2") {149 $ table = "company_statis"; 150 $ table2 = "company "; 151 $ value = "'uid' = '". $ userid. "',". $ this-> rating_info (); 152 $ value2 = "'uid' = '". $ userid. "', 'linkmail' = '". $ _ POST ['email ']. "', 'name' = '". $ _ POST ['unit _ name']." ', 'Linktel' = '". $ _ POST ['moblil']. "', 'address' = '". $ _ POST ['address']. "'"; // ******** here, the' \ 'introduced by transcoding is imported into SQL, $ _ POST ['address'] to inject code. 153} 154 $ this-> obj-> DB_insert_once ($ table, $ value); 155 $ this-> obj-> DB_insert_once ($ table2, $ value2 ); 156 $ this-> obj-> DB_insert_once ("friend_info", "'uid' = '". $ userid. "', 'nickname' = '". $ _ POST ['username']. "', 'usertype' = '". $ _ POST ['usertype']. "'"); 157 if ($ _ POST ['usertype'] = "1 ") {158 if ($ this-> config ['user _ status'] = "1") {159 $ randstr = rand ); 160 $ base = base64_encode ($ userid. "| ". $ randst R. "| ". $ this-> config ['coding']); 161 $ data_cert ['type'] = "cert "; 162 $ data_cert ['email '] = $ _ POST ['email']; 163 $ data_cert ['url'] = "<a href = '". $ this-> config ['sy _ weburl']. "/index. php? M = qqconnect & c = mcert & id = ". $ base." '> ??????? </A> "; 164 $ data_cert ['date'] = date (" Y-m-d "); 165 $ this-> send_msg_email ($ data_cert ); 166 $ msg = "7 ##???????????????????????????? "; 167} else {168 $ this-> add_cookie ($ userid, $ _ POST ['username'], $ salt, $ _ POST ['email '], $ pass, $ usertype); 169 $ this-> regemail ($ _ POST); 170 $ msg = 1; 171} 172} elseif ($ usertype = "2 ") {173 $ this-> regemail ($ _ POST); 174 if ($ this-> config ['com _ status']! = "1") {175 $ msg = "7 ##??????,?????????????? "; 176} else {177 $ msg = 1; 178 $ this-> add_cookie ($ userid, $ _ POST ['username'], $ salt, $ _ POST ['email '], $ pass, $ usertype); 179} 180 echo $ msg; die; 182} else {183 echo "8 ##??????? "; Die; 184} 185} else {186 echo" 8 ##????????????? "; Die; 187} 188}

The SQL statement is as follows:


 

 

Proof of vulnerability:

 

 

Solution:

Filter before entering SQL