WiiNews (Mobile news system) injection vulnerability and Solution

Vulnerability file: newsDetail. php
Vulnerability Type: SQL Injection Vulnerability
Vulnerability discovery: Fa1c0n

SQL Injection Vulnerabilities expose database structures and host-related information, resulting in information leakage and a large amount of user information leakage.

Detailed description:

Code snippet:

"?>

$ Id = sqlReplace (Trim ($ _ GET ['id']);

$ SqlStr = "select * from wiinews_news where news_id = $ id ";

$ Result = mysql_query ($ sqlStr) or die ("query failed. Check the SQL statement. Code: 1010 ");

$ Row = mysql_fetch_array ($ result );
.....
.....
The code below is omitted...

$ Id = sqlReplace (Trim ($ _ GET ['id']);
Let's take a look at what the sqlReplace function has done.

Code snippet:
Function sqlReplace ($ str)

{

$ StrResult = $ str;

If (! Get_magic_quotes_gpc ())
// Www.2cto.com if gpc is not enabled
{

$ StrResult = addslashes ($ strResult );
// Encoding
}

Return HTMLEncode ($ strResult );
// If gpc is enabled, HTMLEncode () is returned ()
}

Function HTMLEncode ($ str ){

If (! Empty ($ str )){

$ Str = str_replace ("&", "&", $ str );

$ Str = str_replace (">", ">", $ str );

$ Str = str_replace ("<", "<", $ str );

$ Str = str_replace (CHR (32), "", $ str );

$ Str = str_replace (CHR (9), "", $ str );

$ Str = str_replace (CHR (9), "", $ str );

$ Str = str_replace (CHR (34), "", $ str );

$ Str = str_replace (CHR (39), "'", $ str );

$ Str = str_replace (CHR (13), "", $ str );

$ Str = str_replace (CHR (10 ),"
", $ Str );

}

// As you can see, only quotes and spaces are blocked, and functions similar to and select are not blocked.
Return $ str;

}
Proof of vulnerability:
Can we construct newsDetail. php? Id = 1 + AND + 1 = 1 for SQL injection.
Solution:
Filter more

Author: Lu renjia