Qibocms B2B Injection

B2B system. In news/js. php

f($type=='hot'||$type=='com'||$type=='new'||$type=='lastview'||$type=='like')  {   if($f_id)   {    if(is_numeric($f_id)){     $SQL=" fid=$f_id ";    }else{     $detail=explode(",",$f_id);     $SQL=" fid IN ( ".implode(",",$detail)." ) ";    }   }   else   {    $SQL=" 1 ";   }   if($type=='com')   {    $SQL.=" AND levels=1 ";    $ORDER=' list ';    $_INDEX=" USE INDEX ( list ) ";   }   elseif($type=='hot')   {    $ORDER=' hits ';    $_INDEX=" USE INDEX ( hits ) ";   }   elseif($type=='new')   {    $ORDER=' list ';    $_INDEX=" USE INDEX ( list ) ";   }   elseif($type=='lastview')   {    $ORDER=' lastview ';    $_INDEX=" USE INDEX ( lastview ) ";   }   elseif($type=='like')   {    $SQL.=" AND id!='$id' ";    if(!$keyword)    {     extract($db->get_one("SELECT keywords AS keyword FROM {$_pre}content WHERE id='$id'"));    }    if($keyword){     $SQL.=" AND ( ";     $keyword=urldecode($keyword);     $detail=explode(" ",$keyword);     unset($detail2);     foreach( $detail AS $key=>$value){      $detail2[]=" BINARY title LIKE '%$value%' ";     }     $str=implode(" OR ",$detail2);     $SQL.=" $str ) ";    }else{     $SQL.=" AND 0 ";

 

The keyword is decoded. Therefore, the global escape is ignored. Then use spaces to cut. No space is allowed. The test is successful on the official website.