Qibocms classification injection can be upgraded to management by yourself

Qibocms classification system. In member/company. php

$ CpDB = $ db-> get_one ("SELECT * FROM '{$ pre} memberdata_1' WHERE uid = '$ lfjuid'"); if ($ step = 2) {foreach ($ _ post as $ key =>$ value) {$ _ POST [$ key] = filtrate ($ value) ;}@ extract ($ _ POST ); if (! $ Cpname) {showerr ("enterprise name cannot be blank");} if (! $ Cptype) {showerr ("select enterprise type");} if (! $ Cptrade) {showerr ("select the enterprise industry");} if (! $ Cpfounder) {showerr ("enterprise legal representative cannot be blank");} if (! $ Cptelephone) {showerr ("company phone number cannot be blank");} if (! $ Cpaddress) {showerr ("company address cannot be blank");} if (! $ Cpcity) {showerr ("select the city of the enterprise");} if (! $ Cpcode) {showerr ("Organization Code cannot be blank");} if (! Ereg ("^ [0-9] {8}", $ cpcode) {showerr ("Please enter the Organization Code carefully"); // if you do not want to strictly control the Organization Code, please delete this line} if (! $ CpDB) {$ db-> query ("insert into '{$ pre} memberdata_1' ('uid', 'cpname', 'cptype', 'cptype ', 'cptrade ', 'cpproduct', 'cpcity', 'cpfoundtime', 'cpfounder', 'cpmannum', 'cpmoney', 'cpcode', 'cppermit ', 'cpweb ', 'cppostcode', 'cptelphone', 'cpfax', 'cpaddress', 'cplinkman ', 'cpmobphone', 'cpqq', 'cpmsn ') VALUES (' $ lfjuid ', '$ cpname',' $ cplogo ',' $ cptype ',' $ cptrade ',' $ cpproduct', '$ cpcity ',' $ Cpfoundtime ',' $ cpfounder ',' $ cpmannum ',' $ cpmoney ',' $ cpcode ',' $ cppermit ',' $ cpweb', '$ cppostcode ', '$ cptelephone', '$ cpfax', '$ cpaddress', '$ cplinkman', '$ cpmobphone', '$ cpqq', '$ cpmsn ')"); $ grouptype = $ webdb [AutoPassCompany]? '1': '-1'; $ db-> query ("UPDATE {$ pre} memberdata SET grouptype =' $ grouptype 'where uid = '$ lfjuid '"); refreshto ("company. php? Job = edit "," Your materials have been submitted ", 1);} else {$ db-> query (" UPDATE {$ pre} memberdata_1 SET cpname = '$ cpname ', cplogo = '$ cplogo', cptype = '$ cptype', cptrade =' $ cptrade ', cpproduct =' $ cpproduct', cpcity = '$ cpcity ', cpfoundtime = '$ cpfoundtime', cpfounder =' $ cpfounder', cpmannum = '$ cpmannum', cpmoney =' $ cpmoney ', cpcode =' $ cpcode ', cppermit = '$ cppermit', cpweb = '$ cpweb', cppostcode =' $ cppostcode', cptelephone = '$ cptelephone', cpfax = '$ cpfax', cpaddh Ss = '$ cpaddress', cplinkman =' $ cplinkman ', cpmobphone =' $ cpmobphone ', cpqq =' $ cpqq ', cpmsn = '$ cpmsn' WHERE uid = '$ lfjuid' "); refreshto (" company. php? Job = edit "," modified successfully ", 1 );}}

 

Here there is an obvious variable that overwrites the extract to overwrite the table prefix and then complete the statement by yourself. We can see an update later. Therefore, you can directly upgrade yourself to management.