 |
|
 |
PortWatcher's Blog
Monday, 2025-06-30, 4:45 AM Welcome Guest
BlogMain » 2012 » November » 13 » WordPress AJAX Post Search插件'srch_txt'参数SQL注入漏洞
11:55 PM WordPress AJAX Post Search插件'srch_txt'参数SQL注入漏洞 |
我特地下载了这个插件的1.1版本,源码只有一个php文件,cardoza_ajax_search.php。
搜索"srch_txt",来到42行,代码如下: Code
if(isset($_POST['srch_txt'])){ $search_string = stripslashes($_POST['srch_txt']); if(!empty($search_string)){ global $wpdb; $search_result_posts = $wpdb->get_col("select ID from $wpdb- >posts where post_title like '%".$search_string."%' AND post_status = 'publish'"); if(sizeof($search_result_posts)!=0){ $args = array('post__in'=>$search_result_posts); $res = new WP_Query($args); echo '<ul>'; while ( $res->have_posts() ) : $res->the_post();?> <li><a href=""></a></li> <?php endwhile; echo '</ul>'; } else echo "No posts found for your search"; } else echo "Type your search in the search box."; wp_reset_query(); die(); }
可以看到,srch_txt未经任何过滤就带入了SQL语句里面进行查询,一个十分典型的搜索型注入。
影响版本有1.0,1.1,1.2
在最新的1.3版本中,加了一个htmlspecialchars函数对POST来的数据进行了转义: Code $search_string = stripslashes($_POST['srch_txt']);
|
Category: 漏洞信息 |
Views: 1552 |
Added by: Jury
| Rating: 0.0/0 |
|
 |