Simple-Log 1.2 Delayed Injection Vulnerability and repair

Vulnerability files:
/User. php

Continue to follow up the isset_member function usage. Part of the Code is truncated.
/Shortdes/base. function. php

Do not make further calls, so as to avoid confusion. You only need to submit the admin + injection statement in POST to make it true. Because admin is the Administrator name, most people will not change it. So the final value is true.
Post submission. You can create a form. I will not issue EXP here. You have to manually send the messages one by one. Find the tool... I did not perform the test because of manual trouble.

Fix: Filter