SQL 注入

error/data/prvd/src/sink/sqli/001-mysqli_query.php in mysqli_queryphp

DEDECMS-V

解决

忽略

链接问题跟踪器

172.17.0.1

ID: 7cmrl5osvgfpv21l4dvc549qin

Unknown Browser

php

版本： 7.2.9

消息

SQL 注入

Stacktrace(最近的调用最先显示)

全部原始数据

/data/prvd/src/sink/sqli/001-mysqli_query.php in mysqli_query at line 5
1. <?php
4. function mysqli_query($link, $query, $resultmode=MYSQLI_STORE_RESULT) {
5. prvd_check_sqli($query, prvd_translate("Sql Injection"));
6. return call_user_func(PRVD_RENAME_PREFIX."mysqli_query", $link, $query, $resultmode);
7. }
/var/www/html/include/dedesqli.class.php in Execute at line 315
1. CheckSql($this->queryString);
2. }
4. $t1 = ExecTime();
5. //var_dump($this->queryString);
6. $this->result[$id] = mysqli_query($this->linkID, $this->queryString);
7. //var_dump(mysql_error());
9. //查询性能测试
10. if($this->recordLog) {
11. $queryTime = ExecTime() - $t1;
/var/www/html/include/dedesqli.class.php in GetOne at line 354
1. if(!empty($sql))
2. {
3. if(!preg_match("/LIMIT/i",$sql)) $this->SetQuery(preg_replace("/[,;]$/i", '', trim($sql))." LIMIT 0,1;");
4. else $this->SetQuery($sql);
5. }
6. $this->Execute("one");
7. $arr = $this->GetArray("one", $acctype);
8. if(!is_array($arr))
9. {
10. return '';
11. }
/var/www/html/include/arc.archives.class.php in GetPreNext at line 809
1. $rs = '';
2. if(count($this->PreNext)<2)
3. {
4. $aid = $this->ArcID;
5. $preR = $this->dsql->GetOne("Select id From `#@__arctiny` where id<$aid And arcrank>-1 And typeid='{$this->Fields['typeid']}' order by id desc");
6. $nextR = $this->dsql->GetOne("Select id From `#@__arctiny` where id>$aid And arcrank>-1 And typeid='{$this->Fields['typeid']}' order by id asc");
7. $next = (is_array($nextR) ? " where arc.id={$nextR['id']} " : ' where 1>2 ');
8. $pre = (is_array($preR) ? " where arc.id={$preR['id']} " : ' where 1>2 ');
9. $query = "Select arc.id,arc.title,arc.shorttitle,arc.typeid,arc.ismake,arc.senddate,arc.arcrank,arc.money,arc.filename,arc.litpic,
10. t.typedir,t.typename,t.namerule,t.namerule2,t.ispart,t.moresite,t.siteurl,t.sitepath
11. from `#@__archives` arc left join #@__arctype t on arc.typeid=t.id ";
/var/www/html/include/arc.archives.class.php in ParseDMFields at line 733
1. $this->dtp->Assign($i,$this->GetPageTitlesST($ctag->GetAtt("style"),$pageNo));
2. }
3. }
4. else if($ctag->GetName()=='prenext')
5. {
6. $this->dtp->Assign($i,$this->GetPreNext($ctag->GetAtt('get')));
7. }
8. else if($ctag->GetName()=='fieldlist')
9. {
10. $innertext = trim($ctag->GetInnerText());
11. if($innertext=='') $innertext = GetSysTemplets('tag_fieldlist.htm');
/var/www/html/include/arc.archives.class.php in MakeHtml at line 421
1. }
2. else
3. {
4. $TRUEfilename = $this->GetTruePath().$filename;
5. }
6. $this->ParseDMFields($i,1);
7. $this->dtp->SaveTo($TRUEfilename);
8. //如果启用远程发布则需要进行判断
9. if($cfg_remote_site=='Y' && $isremote == 1)
10. {
inc/inc_archives_functions.php in MakeArt at line 402
1. {
2. global $envs, $typeid;
3. require_once(DEDEINC.'/arc.archives.class.php');
4. if($ismakesign) $envs['makesign'] = 'yes';
5. $arc = new Archives($aid);
6. $reurl = $arc->MakeHtml($isremote);
7. return $reurl;
8. }
10. /**
11. * 取第一个图片为缩略图
archives_do.php at line 223
1. $qstrs = explode('`',$qstr);
2. $i = 0;
3. foreach($qstrs as $aid)
4. {
5. $i++;
6. $pageurl = MakeArt($aid,false);
7. }
8. ShowMsg("成功更新指定 $i 个文件...",$ENV_GOBACK_URL);
9. exit();
10. }
11. /*--------------------------

Breadcrumbs

21:52:14

error_reporting	`mysqli_query() expects parameter 1 to be mysqli, string given`
line	6
code	2
file	/data/prvd/src/sink/sqli/001-mysqli_query.php

21:52:14

error_reporting	`Undefined offset: 1`
line	114
code	8
file	/var/www/html/include/dedesqli.class.php

21:52:14

error_reporting	`mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given`
line	393
code	2
file	/var/www/html/include/dedesqli.class.php

21:52:14

error_reporting	`preg_replace_callback(): Requires argument 2, '_highlight('\2', $karr, $kaarr, '\1')', to be a valid callback`
line	1233
code	2
file	/var/www/html/include/arc.archives.class.php

21:52:14

error_reporting	`mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given`
line	393
code	2
file	/var/www/html/include/dedesqli.class.php

21:52:14
message
SQL 注入

Formatted curl

GET/dede/archives_do.phplocalhost

查询字符串

aid	261
dopost	makeArchives
qstr	1'"><xtanzi>./../xtanzi

Cookies

DedeLoginTime	1541766503
DedeLoginTime__ckMd5	be38df79a9298232
DedeUserID	1
DedeUserID__ckMd5	5ebcf2784562fcbb
ENV_GOBACK_URL	/dede/content_list.php?channelid=6
PHPSESSID	********
_csrf_name_36da6296	d769aa52e6fd810e6969605155173d8d
_csrf_name_36da6296__ckMd5	fd74c8a16f6cf59f
menuitems	1_1,2_1,3_1,4_1,5_1

标头

Accept	text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding	gzip, deflate, br
Accept-Language	zh-CN,zh;q=0.9,en;q=0.8
Connection	keep-alive
Host	localhost:8080
Prvd-Fuzzer	halo_from_fate0
Upgrade-Insecure-Requests	1
User-Agent	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36

User

Runtime

Name	php
Version	7.2.9

SDK

姓名	sentry-php
版本	1.9.2

Ownership Rules

Create Ownership Rule

All Environments

首次出现时间

时间:: a few seconds ago
Nov 9, 2018 9:52:14 PM HKT
版本:: not configured

最后出现时间

时间:: a few seconds ago
Nov 9, 2018 9:52:14 PM HKT
版本:: not configured

通知

由于已订阅工作流通知你正在接受该项目的更新。

bigfile_info	[]
dede_admin_channel	0
dede_admin_id	1
dede_admin_name	admin
dede_admin_purview	admin_AllowAll
dede_admin_style	newdedecms
dede_admin_type	10
file_info	[]
securimage_code_value	2h9o
token	878d78d1285914e1d5dfa077694de322

SQL 注入

问题 #

事件

用户

Assignee

172.17.0.1

Unknown Browser

php

标签

消息

Stacktrace(最近的调用最先显示)

GET/dede/archives_do.phplocalhost

查询字符串

Cookies

标头

User

Runtime

SDK

Ownership Rules

All Environments

最近 24 小时

最近 30 天

首次出现时间

最后出现时间

标签

level

logger

runtime

runtime.name

server_name

site

url

user

通知

link	Object mysqli
query	Select id From `dede_arctiny` where id>1\'\"><xtanzi>./../xtanzi And arcrank>-1 And typeid='2' order by id asc LIMIT 0,1;

ismake	1
pageNo	1

aid	1\'\"><xtanzi>./../xtanzi
mkindex	false

SQL 注入

问题 #

事件

用户

Assignee

事件 6b0941c0310642e68aff51112988ed54

172.17.0.1

Unknown Browser

php

标签

消息

Stacktrace(最近的调用最先显示)

Breadcrumbs

GET/dede/archives_do.phplocalhost

查询字符串

Cookies

标头

User

Runtime

SDK

Ownership Rules

All Environments

最近 24 小时

最近 30 天

首次出现时间

最后出现时间

标签

level

logger

runtime

runtime.name

server_name

site

url

user

通知