The SQL injection of Taocms can ignore GPC.

Filtering is lax. In index. php

include(SYS_ROOT.INC.'common.php');$path=$_SERVER['PATH_INFO'].($_SERVER['QUERY_STRING']?'?'.str_replace('?','',$_SERVER['QUERY_STRING']):'');if(substr($path, 0,1)=='/'){$path=substr($path,1);}$ctrl=isset($_GET['action'])?$_GET['action']:'run';if(isset($_GET['createprocess'])){Index::createhtml(isset($_GET['id'])?$_GET['id']:0,$_GET['cat'],$_GET['single']);}else{Index::$ctrl($path);}

 

Path is from query_string, so it is not subject to gpc.

$ctrl=isset($_GET['action'])?$_GET['action']:'run';if(isset($_GET['createprocess'])){Index::createhtml(isset($_GET['id'])?$_GET['id']:0,$_GET['cat'],$_GET['single']);}else{Index::$ctrl($path);}?>

 

Here we can control the function to be imported.

static public function getatlbyid($id){if(!$id)return null;self::$_db=new Dbclass(SYS_ROOT.DB_NAME);if(MEMCACHE){self::$_mem=new Memcached(MEMCACHE);if(!$atl=self::$_mem->get($id.'_cms')){$atl=self::$_db->get_one(TB."cms",'status=1 and id='.$id,"*",1);;self::$_mem->set($id.'_cms',$atl);}}else{$atl=self::$_db->get_one(TB."cms",'status=1 and id='.$id,"*",1);}return $atl;}

 

Find this function for injection. A picture has a truth. Solution:Filter.