dedecms v5.7最新漏洞分析（Dedecms v5.7 the latest vulnerability analysis）.docVIP

dedecms v5.7最新漏洞分析（Dedecms v5.7 the latest vulnerability analysis） DeDeCMS v5.7 the latest vulnerability analysis (DeDeCMS. CMS) is a domestic professional PHP web content management system, from the year 04 issue, has been nearly seven years, has experienced numerous upgrades and revision, the latest version for the August 12 update V5.7 official version, function has also been enhanced. I thought it should be a high security CMS system, but the analysis is confused, confused system of domestic professional after seven years of development, its security is still worrying. Perhaps the network had no absolute security. Injection A loophole: the /member/ajax_membergroup.php page membergroup variable does not cause a digital filter type injection, the key code is as follows: Edit group Elseif ($action =post) { If (empty ($membergroup)) { You have not set the packet echo! ; Exit; } $sql = UPDATE SET `groupid`={$membergroup}WHERE `fid`={$mid} AND `mid`={$cfg_ml-M_ID};; $dsql-ExecuteNoneQuery ($sql); $row = $dsql-GetOne (SELECT groupname FROM WHERE mid = {$cfg_ml-M_ID} AND id={$membergroup}); / / digital injection Echo .$row[groupname]. a href=#onclick=EditMemberGroup ($mid); return false; Modify /a; Obviously, when the action=post, $membergroup to digital DeDeCMS injection vulnerability, but before accessing the MySql database, using CheckSql () custom function to conduct safety inspections of the SQL statement, can not be directly injected. Bypass injection. CheckSql () function is defined in the /include/dedesql.class.php or /include/dedesqli.class.php database file, the code is as follows: If (! Function_exists (CheckSql)) {function CheckSql ($db_string, $querytype=select) {global $cfg_cookie_encode; $clean = ; $error=; $old_pos = 0; $pos = -1; (omitted)... / / if is ordinary query, some special grammar direct filtration If ($querytype==select) {$notallow1= [^0-9a-z@\._-]{1, [^0-9a-z@\.-]{1 (union|sleep|benchmark|load_file|outfile)}} ; //[^0-9a-z@\._-]{1, at lea