###0x01漏洞简介
TCcms v9.0 版本在文件/app/controller/user.class.php处的参数userId 存在SQL注入漏洞。
###0x02漏洞分析
先看文件/app/model/newsAction.class.php,108行开始
```
public function getCountByUid() {
$info = $this->query("select count(*) as total from tc_news where uid=".$_COOKIE["userId"]);
return $info[0]["total"];
}
}
```
再看看getCountByUid函数被应用在何处,/app/controller/user.class.php,228行开始
```
public function home() {
$this->userIsLogin ();
$newsObj = M ( "news" );
$newsTotal = $newsObj->getCountByUid ();
$this->setValue ( "newsTotal", $newsTotal );
$this->forward ( "user/home.html" );
}
```
![](https://images.seebug.org/contribute/0a8186f1-bbce-4650-a059-34408eec90ab)
###0x03修复方案
过滤。
暂无评论