phpcms2008漏洞
下面是官方到目前为止还没有打补丁的几个漏洞
http://www.tmdsb.com/flash_upload.php?modelid=1
注入漏洞
$field = new model_field($modelid);$info = $field->get($fieldid);
?
问题就出在标红的。。跟进去看下
立即学习“PHP免费学习笔记（深入）”；
function __construct($modelid) { global $db; $this->db = &$db; $this->table = DB_PRE.'model_field'; echo($modelid); $model = $this->db->get_one("SELECT * FROM ".DB_PRE."model WHERE modelid=$modelid"); $this->modelid = $model['modelid']; $this->modelname = $model['name']; $this->fields = cache_read($modelid.'_fields.inc.php', CACHE_MODEL_PATH); $this->tablename = DB_PRE.'c_'.$model['tablename']; }?
构造方法中调用了select...所以忘了过滤。。。
