PHPMyWind Background Management Interface SQL Injection Vulnerability

PHPMyWind Background Management Interface SQL Injection Vulnerability

The SQL injection vulnerability is caused by poor filtering on the background management interface. administrators with lower permissions can obtain higher permissions and obtain and modify the super administrator username and password.

The problematic code is admin_save.php 59-101. $ id in the SQL statement is injected.

 

Else if ($ action = 'update') {// The Founder account cannot change the status if ($ id = 1 and ($ checkadmin! = 'True' or $ levelname! = '1') {ShowMsg ('Sorry, you cannot change the status of the founding account! ','-1'); exit ();} // only the super Administrator has the right to modify the super administrator if ($ administrative _adminlevel> 1 and $ levelname = 1) {ShowMsg ('invalid operation, cannot be changed to super administrator! ','-1'); exit ();} if ($ password = '') {$ SQL =" updat' $ tbname 'set nickname = '$ nickname ', question = '$ question', answer = '$ answer', levelname = '$ levelname', checkadmin =' $ checkadmin' WHERE id = $ id ";} else {$ oldpwd = md5 (md5 ($ oldpwd); $ password = md5 (md5 ($ password )); $ r = $ dosql-> GetOne ("SELECT 'Password' FROM 'dede _ admin' WHERE id = $ id"); if ($ r ['Password']! = $ Oldpwd) {ShowMsg ('Sorry, the old password is incorrect! ','-1'); exit () ;}$ SQL = "updat' $ tbname' SET password = '$ password', nickname =' $ nickname ', question = '$ question', answer = '$ answer', levelname = '$ levelname', checkadmin =' $ checkadmin' WHERE id = $ id ";} if ($ dosql-> ExecNoneQuery ($ SQL) {header ("location: $ gourl"); exit ();}}

 

The parameters of many SQL statements below are not filtered.

86 rows
 

$r = $dosql->GetOne("SELECT `password` FROM `dede_admin` WHERE id=$id");

79 rows
 

$sql = "UPDATE `$tbname` SET nickname='$nickname', question='$question', answer='$answer', levelname='$levelname', checkadmin='$checkadmin' WHERE id=$id";

93 rows
 

$sql = "UPDATE `$tbname` SET password='$password', nickname='$nickname', question='$question', answer='$answer', levelname='$levelname', checkadmin='$checkadmin' WHERE id=$id";

115 rows
 

$sql = "UPDATE `$tbname` SET checkadmin='false' WHERE `id`=$id";

In short, none of them are filtered.

Solution:

Intval ()