ZYADS SQL injection and local inclusion Vulnerabilities

ZYADS SQL injection and local inclusion Vulnerabilities

Rows 1-31 in index/news. php
<?
Include_once ("top. php ");

$ Newsid = intval ($ _ GET [id]);

$ To_type = addslashes ($ _ GET [type]);

If ($ to_type = index)
{
$ To_type_s = "and to_type = 1 ";
}

If ($ to_type = webuser)
{
$ To_type_s = "and to_type! = 3 ";
}

If ($ to_type = webadver)
{
$ To_type_s = "and to_type! = 2 ";
}

$ Newssql = select * from zyads_news WHERE 'id' =. $ newsid.

. $ To_type_s .;

$ Newsre = $ db-> query ($ newssql );
$ Newsrow = $ db-> fetch_array ($ newsre );
If (empty ($ newsrow )){

Zyads_message (zyads_news );
}
?>

We can see that $ to_type is not defined or is not equal to index, webuser, webadver, then $ to_type_s is not defined.

At this time, we can submit a $ to_type_s variable for SQL injection. Simple injection.

In/code/adview_cpa_html.php 1-46
<? Php
/*********************/
/**/
/* Version: 5.1.0 */
/* Author: RM */
/* Comments: 071223 */
/**/
/*********************/

_ Obfuscate_JQYdYn1jfBI