YouYaX SQL injection and repair solutions

/Ext/register. php file when ($ mix ['is _ prevent_reg '] is true

if($mix['is_prevent_reg']){if (!empty($_SERVER['HTTP_CLIENT_IP']))        $myIp = $_SERVER['HTTP_CLIENT_IP'];    else if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))        $myIp = $_SERVER['HTTP_X_FORWARDED_FOR'];    else        $myIp = $_SERVER['REMOTE_ADDR'];    $sql    = "select * from " . $config['db_prefix'] . "user where ip_addr='" . $myIp . "'";    $result = mysql_query($sql);    $num    = mysql_num_rows($result);

 

The IP address can be forged for injection, because it is appropriate to use Delayed Injection instead of ECHO. here, we echo the SQL statement to prove the vulnerability to make it easier for the Administrator to reproduce the Vulnerability (this CMS also needs to configure the email server, and I will comment out the code) copy my code and paste it again.

<? Phpinclude ('.. /ext_public/include. php '); include ('.. /ext_public/database. php '); function doUserCount ($ param) {$ count_arr = mysql_fetch_array (mysql_query ("select * from ". $ param. "count where id = 1"); $ data = unserialize ($ count_arr ['user _ count']); $ date = date ('w', time ()); $ date2 = date ('w', time (); if ($ date2! = $ Count_arr ['Week _ order']) {mysql_query ("update ". $ param. "count set user_count ='', post_count = '', week_order = '". $ date2. "'where id = 1"); $ count_arr = mysql_fetch_array (mysql_query ("select * from ". $ param. "count where id = 1"); $ data = unserialize ($ count_arr ['user _ count']);} switch ($ date) {case 0: @ $ data ['G'] ++; break; case 1: @ $ data ['a'] ++; break; case 2: @ $ data ['B'] ++; break; case 3: @ $ data ['C'] ++; break; cas E 4: @ $ data ['D'] ++; break; case 5: @ $ data ['E'] ++; break; case 6: @ $ data ['F'] ++; break;} mysql_query ("update ". $ param. "count set user_count = '". serialize ($ data ). "'where id = 1");} if (isset ($ _ POST ['sub']) {if (empty ($ config ['default _ user_group ']) | empty ($ config ['not _ log_in_user_group ']) {echo "<script> alert ('Go to the background [Register activation management-configuration] To set registration and Default User Group not logged in '); </script>"; exit ;} $ user = htmlspecialchars (addslashes (trim ($ _ POS T ['user']), ENT_QUOTES, "UTF-8"); if (mb_strlen ($ user, 'utf8')> 7 | mb_strlen ($ user, 'utf8 ') <2) {echo "<script> alert ('username length must be 2 ~ Between 7 characters '); </script> "; echo" <script> window. parent. location. href = '". url_site. "'; </script>"; exit;} if (empty ($ _ POST ['pass']) {echo "<script> alert ('password required '); </script>"; echo "<script> window. parent. location. href = '". url_site. "'; </script>"; exit;} $ pass = md5 (addslashes ($ _ POST ['pass']); $ _ POST ['email '] = addslashes ($ _ POST ['email']); if (empty ($ _ POST ['email ']) {echo "<script> alert ('mailbox name mandatory '); </SC Ript> "; echo" <script> window. parent. location. href = '". url_site. "'; </script>"; exit;} if ($ mix ['is _ prevent_reg']) {if (! Empty ($ _ SERVER ['HTTP _ CLIENT_IP ']) $ myIp = $ _ SERVER ['HTTP _ CLIENT_IP']; else if (! Empty ($ _ SERVER ['HTTP _ X_FORWARDED_FOR ']) $ myIp = $ _ SERVER ['HTTP _ X_FORWARDED_FOR']; else $ myIp = $ _ SERVER ['remote _ ADDR ']; $ SQL = "select * from ". $ config ['db _ prefix']. "user where ip_addr = '". $ myIp. "'"; $ result = mysql_query ($ SQL); var_dump ($ SQL); $ num = mysql_num_rows ($ result ); if ($ num >=$ mix ['prevent _ reg_num ']) {echo "<script> alert ('registration failed, this IP address has been used more ". $ mix ['prevent _ reg_num ']. "Times '); </script> "; Echo" <script> window. parent. location. href = '". url_site. "'; </script>"; exit ;}$ code = ''; for ($ I = 0; $ I <6; $ I ++) {$ code. = mt_rand (0, 9);} if ($ config ['register _ mode'] = 1) {/* $ mailconf = require (".. /Conf/mail. config. php "); if (empty ($ mailconf ['mail _ host']) & empty ($ mailconf ['mail _ username']) & amp; empty ($ mailconf ['mail _ password']) {echo "<script> alert ('email server not configured in the administrator backend '); </script> "; exit ;}*/} Mysql_query ("set names 'utf8'"); mysql_query ("SET SQL _mode ='' "); date_default_timezone_set ('Asia/Shanghai '); $ SQL = "select * from ". $ config ['db _ prefix']. "user where user = '". $ user. "'"; $ result = mysql_query ($ SQL); $ num = mysql_num_rows ($ result); // you can check whether the node is registered. if ($ num> 0) {echo "<script> alert ('the user name has been registered '); </script>"; echo "<script> window. parent. location. href = '". url_site. "'; </script> ";} Else {$ sql2 = "select * from ". $ config ['db _ prefix']. "user where email = '". $ _ POST ['email ']. "'"; $ result2 = mysql_query ($ sql2); $ num2 = mysql_num_rows ($ result2); if ($ num2> 0) {echo "<script> alert ('mailbox name registered '); </script>"; echo "<script> window. parent. location. href = '". url_site. "'; </script>"; exit;} else {if ($ config ['register _ mode'] = 1) {/* require_once (".. /ext_public/phpmailer/class. phpm Ailer. php "); $ mail = new PHPMailer (); $ mail-> IsSMTP (); $ mail-> Host = $ mailconf ['mail _ host']; $ mail-> SMTPAuth = true; $ mail-> Username = $ mailconf ['mail _ username']; $ mail-> Password = $ mailconf ['mail _ password']; $ mail-> From = $ mailconf ['mail _ from']; $ mail-> FromName = $ mailconf ['mail _ fromname']; $ mail-> AddAddress ($ _ POST ['email ']); $ mail-> IsHTML (true); $ mail-> CharSet = "UTF-8 "; $ mail-> Encoding = "base6 4 "; $ mail-> Subject = $ mailconf ['mail _ subobject']; $ mail-> Body = $ mailconf ['mail _ body']. "<a href = '". url_site. "/ext/mail_active.php? User = ". $ user. "& pass = ". $ pass. "& email = ". $ _ POST ['email ']. "& code = ". $ code. "'> click here to activate </a>"; if (! Empty ($ _ POST ['email ']) {exit;} */if ($ mix ['is _ prevent_reg']) {$ SQL = "insert ". $ config ['db _ prefix']. "user (user, pass, status, email, complete, face, time, fatieshu, bid, codes, ip_addr, user_group) values ('". $ user. "','". $ pass. "', 0 ,'". $ _ POST ['email ']. "', '0', '00.gif', now (), 0 ,'". $ mix ['bid _ init ']. "','". $ code. "','". $ myIp. "','". $ config ['default _ user_group ']. "')";} else {$ SQL = "insert int O ". $ config ['db _ prefix']. "user (user, pass, status, email, complete, face, time, fatieshu, bid, codes, user_group) values ('". $ user. "','". $ pass. "', 0 ,'". $ _ POST ['email ']. "', '0', '00.gif', now (), 0 ,'". $ mix ['bid _ init ']. "','". $ code. "','". $ config ['default _ user_group ']. "')";} mysql_query ($ SQL); doUserCount ($ config ['db _ prefix']); echo "<script> alert (' registered successfully, please go to your mailbox to activate it! '); </Script> "; echo" <script> window. parent. location. href = '". url_site. "'; </script>" ;}else {if (addslashes ($ _ POST ['valicode'])! = $ _ SESSION ['verify ']) {echo "<script> alert ('incorrect verification code! '); </Script> "; exit;} else {if ($ mix ['is _ prevent_reg']) {$ SQL =" insert ". $ config ['db _ prefix']. "user (user, pass, status, email, complete, face, time, fatieshu, bid, codes, ip_addr, user_group) values ('". $ user. "','". $ pass. "', 1 ,'". $ _ POST ['email ']. "', '0', '00.gif', now (), 0 ,'". $ mix ['bid _ init ']. "','". $ code. "','". $ myIp. "','". $ config ['default _ user_group ']. "')";} else {$ SQL = "insert ". $ co Nfig ['db _ prefix']. "user (user, pass, status, email, complete, face, time, fatieshu, bid, codes, user_group) values ('". $ user. "','". $ pass. "', 1 ,'". $ _ POST ['email ']. "', '0', '00.gif', now (), 0 ,'". $ mix ['bid _ init ']. "','". $ code. "','". $ config ['default _ user_group ']. "')";} mysql_query ($ SQL); doUserCount ($ config ['db _ prefix']); echo "<script> alert ('registration successful! '); </Script> "; $ _ SESSION ['youyax _ data'] = 1; $ _ SESSION ['youyax _ user'] = $ user; $ _ SESSION ['youyax _ bz'] = 1; echo "<script> window. parent. location. href = '". url_site. "'; </script>" ;}}}}?>

 

Solution:IP address Regular Expression judgment