Server guard talent system SQL injection causes arbitrary User Password Modification

Server guard talent system SQL injection causes arbitrary User Password Modification

Server guard talent system SQL injection causes arbitrary User Password Modification

Wap_password.php:
 

Elseif ($ act = 'Save _ password') {require_once (QISHI_ROOT_PATH. 'include/fun_user.php '); $ arr ['username'] = $ _ SESSION ['username']; $ arr ['oldpassword'] = trim ($ _ POST ['oldpassword'])? Trim ($ _ POST ['oldpassword']): exit ('enter the old password! '); $ Arr ['Password'] = trim ($ _ POST ['Password'])? Trim ($ _ POST ['Password']): exit ('enter a new password! '); If ($ arr ['Password']! = Trim ($ _ POST ['password1 ']) exit ('the two passwords are different. Please enter them again! '); // Edit_password () method for changing the password $ info = edit_password ($ arr );

We followed up on the edit_password function:

Fun_user.php:
 

Function edit_password ($ arr, $ check = true) {global $ db, $ QS_pwdhash; if (! Is_array ($ arr) return false; $ user_info = get_user_inusername ($ arr ['username']); $ pwd_hash = $ user_info ['pwd _ hash']; $ password = md5 (md5 ($ arr ['oldpassword']). $ pwd_hash. $ QS_pwdhash); if ($ check) {$ row = $ db-> getone ("SELECT * FROM ". table ('members '). "WHERE username = '{$ arr ['username']}' and password = '{$ password}' LIMIT 1"); if (empty ($ row )) {return-1 ;}$ md5password = md5 (md5 ($ arr ['Password']). $ pwd_hash. $ QS_pwdhash); if ($ db-> query ("UPDATE ". table ('members '). "SET password = '$ md5password' WHERE username = '". $ arr ['username']. "'") return $ arr ['username']; write_memberslog ($ _ SESSION ['uid'], $ _ SESSION ['utype'], 1004, $ _ SESSION ['username'], "changed password"); return false ;}

If we find username, We will update the password of this user.

Go to the registration page:
 

After registration, we intend to change the password of test.

Then we send the url:

Http: // localhost/74cms_v3.5.20.20151115/upload/wap/personal/wap_password.php? Act = save_password

Post:

Oldpassword = xxxxx & password = yyyy & password1 = yyyy

The password of user test is changed to yyyy.

Log in and see:


 

 

Solution:

Enhanced Filtering