WeiPHP5.0

> [Suggested description]
> WeiPHP <=5.0 is vulnerable to SQL Injection.
>
> ------------------------------------------
>
> [Vulnerability Type]
> SQL Injection
>
> ------------------------------------------
>
> [Vendor of Product]
> Shenzhen Dream Cloud Technology Co., Ltd
>
> ------------------------------------------
>
> [Affected Product Code Base]
> WeiPHP - <=5.0
>
> ------------------------------------------
>
> [Affected Component]
> WeiPHP<=5.0
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Information Disclosure]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> The code audit finds the vulnerability injection point, and SQL injection can be implemented through packet injection
>
> ------------------------------------------
>
> [Discoverer]
> Zyun4

**Reproduction process** 
Start by setting up a local environment
![输入图片说明](https://foruda.gitee.com/images/1757089962615616008/7ae2ba06_14878336.png "屏幕截图")

Through code audit, it was found that SucaiController.class.php->cancelTemplate() has an injection point
Perform manual injection test
URL:public/index.php/admin/Sucai/cancelTemplate?uid=1)%20and%20updatexml(1,concat(0x7e,user(),0x7e),1)--+
![输入图片说明](https://foruda.gitee.com/images/1757090149939846631/25c90e6b_14878336.png "屏幕截图")

Injection testing using SQLMAP
![输入图片说明](https://foruda.gitee.com/images/1757091904766088225/49c91f89_14878336.png "屏幕截图")

Zyun4/CVE

Content Risk Flag

Comments (0)

Zyun4/CVE .gitee-modal { width: 500px !important; }

Content Risk Flag

WeiPHP5.0

Comments (0)

Search

Zyun4/CVE