在线时间:8:00-16:00
迪恩网络APP
随时随地掌握行业动态
扫描二维码
关注迪恩网络微信公众号
author:zzzhhh 一、 跨站漏洞
漏洞产生原因,因为未对输入变量进行编码,跨站语句未经转换直接存储入数据库中。见图1, 图1 二、代码分析 <input type="text" /> <button type="button" style="width:80px;height:35px" onClick="javascript:send_request('tools.php?seacher='+document.getElementById('search').value);">搜索</button> 。。。。省略N行 //63-65行代码 <?php echo $row['SEACHERDATA']; ?> //输出变量SEACHERDATA <span class='hover-animate-left'></span><span class='hover-animate-right'></span></a> <?php } ?> 那我们根据seacher,SEACHERDATA两个变量在\tools.php文件中进行搜索后 ,关键代码34-61行代码,好吧,我把整段选择结构的代码发过来吧 if (empty($seacher)) { $result=mysql_query("SELECT * FROM HBDX_BLUE ".$show); $num_max=mysql_num_rows($result); $result=mysql_query("SELECT * FROM HBDX_BLUE ".$show." ORDER BY TOP ".$hot." LIMIT $startCount,$perNumber"); } else { $datetime = date("Y-m-d H:i:s"); $seacherresult = mysql_query("SELECT * FROM HBDX_SEACHER WHERE SEACHERDATA = '".$seacher."'"); /*查询SEACHERDATA表内的内容输出到seacherresult变量*/ $seachernum = mysql_num_rows($seacherresult); /*统计搜索次数*/ if($seachernum == 0) { mysql_query("INSERT INTO HBDX_SEACHER (SEACHERDATA,SEACHERNUM,DATETIME) VALUES ('$seacher',1,'$datetime')"); /*查询热门搜索关键词次数为0后,将该关键字写入表SEACHERDATA内*/ } else { $row = mysql_fetch_array($seacherresult); /*遍历seacherresult变量结果赋值到row中*/ mysql_query("UPDATE HBDX_SEACHER SET SEACHERNUM = '".($row['SEACHERNUM'] + 1)."' WHERE SEACHERDATA = '".$seacher."'"); } $result=mysql_query("SELECT * FROM HBDX_BLUE WHERE FILETITLE LIKE '%".$seacher."%'"); $num_max=mysql_num_rows($result); $result=mysql_query("SELECT * FROM HBDX_BLUE WHERE FILETITLE LIKE '%".$seacher."%' OR FILETAG LIKE '%".$seacher."%' ORDER BY TOP,ID DESC LIMIT $startCount,$perNumber"); $num=mysql_num_rows($result); } http://www.wooyun.org/bugs/wooyun-2010-037204 |
2022-08-17
2022-09-18
2022-08-17
2022-07-08
2022-08-15
请发表评论