### 简要描述：
多个文件SQL注入
### 详细说明：
search.php（BIWEB企业版几乎所有的该文件都存在这个问题）
举例：Product/search.php 文件24-60行（不止这一处）
```
if(!empty($_REQUEST['product_name'])){
$strKeywords = strval(urldecode(trim($_REQUEST['product_name'])));//只是进行了简单的过滤空格和url解码
$arrKeywords = explode(" ",$strKeywords);//将关键词用空格进行分割
$newArrKeywords = array();
foreach($arrKeywords as $val){
if(trim($val)!=""){
$newArrKeywords[] = $val; //不为空则赋值
}
}
if(count($newArrKeywords)>1){//为数组时的逻辑处理
foreach($newArrKeywords as $key=>$val){
$arrWhere[] = "`title` LIKE '%$val%' OR `summary` LIKE '%$val%' OR `intro` LIKE '%$val%'";//这里进行了SQL语句的拼接，变量val可控
if($key!=0){
$strKeyword .= " , ".$val;
}else{
$strKeyword .= $val;
}
}
}else{
$arrWhere[] = "`title` LIKE '%$newArrKeywords[0]%' OR `summary` LIKE '%$newArrKeywords[0]%'";
$strKeyword = $newArrKeywords[0];
}
$arrLink[] = 'keywords=' . urlencode(trim($_REQUEST['keywords']));
}else check::AlertExit("错误：关键词必须填写!",-1);
if (empty($_GET['page'])) {
$intPage = 1 ;
} else {
$intPage = intval($_GET['page']);
}
$strWhere = implode(' AND ',$arrWhere);
$strWhere = 'where '.$strWhere;
$arrInfoList = $objWebInit->getInfoList($strWhere,' ORDER BY topflag DESC,submit_date DESC',($intPage-1)*$arrGPage['page_size'],$arrGPage['page_size'],'*');
跟踪函数getInfoList
public function getInfoList($where='',$order='',$intStartID = 0,$intListNum = 0,$field = '*',$arrData = array(),$blCount = true,$blComplex = false){
$table = $this->tablename1;
$arrData=(empty($arrData)?array():$arrData);
$limit = '';
if($blComplex){
if($where != '') $where .= " and id <= ( SELECT id FROM `$table` $order LIMIT $intStartID, 1 )";
else $where = " where id <= ( SELECT id FROM `$table` $order LIMIT $intStartID, 1 )";
}
if (!empty($order)) {
$limit .= $order;
}
if (!empty($intListNum)) $limit .= " LIMIT " . $intStartID .','. $intListNum;
$blFetch = false;
if($field === true) {
$arrDBfield = $this->arrGPdoDB['db_table_field'];
unset($arrDBfield['structon_tb']);
$field = implode(',',array_keys($arrDBfield));
}
$arrData = $this->selectDataG($table,$where,$limit,$field,$blFetch,$arrData,$blCount);//关键在这里，终于进入数据库查询函数 selectDataG，造成注入
if(isset($arrData[0]['structon_tb'])) $arrData = $this->loadTableFieldG($arrData);
return $arrData;
}
```
### 漏洞证明：
加单引号报错：
[<img src="https://images.seebug.org/upload/201401/24152208e6c463ff3b962c589fcb28ebdab5c6b0.png" alt="aaa.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201401/24152208e6c463ff3b962c589fcb28ebdab5c6b0.png)
下图可以看到在数据库中的运算
[<img src="https://images.seebug.org/upload/201401/2415230001dc07045ee6135ad2b2fcf603959462.png" alt="sss.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201401/2415230001dc07045ee6135ad2b2fcf603959462.png)
京公网安备 11010502034610号
暂无评论