SQL 注入

error/data/prvd/src/sink/sqli/001-mysqli_query.php in mysqli_queryphp

DEDECMS-B

解决

忽略

链接问题跟踪器

172.17.0.1

ID: 7cmrl5osvgfpv21l4dvc549qin

Unknown Browser

php

版本： 7.2.9

消息

SQL 注入

Stacktrace(最近的调用最先显示)

全部原始数据

/data/prvd/src/sink/sqli/001-mysqli_query.php in mysqli_query at line 5
1. <?php
4. function mysqli_query($link, $query, $resultmode=MYSQLI_STORE_RESULT) {
5. prvd_check_sqli($query, prvd_translate("Sql Injection"));
6. return call_user_func(PRVD_RENAME_PREFIX."mysqli_query", $link, $query, $resultmode);
7. }
/var/www/html/include/dedesqli.class.php in Execute at line 315
1. CheckSql($this->queryString);
2. }
4. $t1 = ExecTime();
5. //var_dump($this->queryString);
6. $this->result[$id] = mysqli_query($this->linkID, $this->queryString);
7. //var_dump(mysql_error());
9. //查询性能测试
10. if($this->recordLog) {
11. $queryTime = ExecTime() - $t1;
makehtml_archives_action.php in include_once at line 91
1. //如果生成数量大于500，并且没选栏目，按栏目排序生成
2. if($totalnum > 500 && empty($typeid))
3. {
4. $dsql->Execute('out',"SELECT id FROM `#@__arctiny` $idsql ORDER BY typeid ASC $limitSql");
5. } else {
6. $dsql->Execute('out',"SELECT id FROM `#@__arctiny` $idsql $limitSql");
7. }
8. if($cfg_remote_site=='Y' && $isremote=="1")
9. {
10. if($serviterm!="")
11. {
makehtml_all.php at line 43
1. /*-------------------
2. function _2_MakeArchives()
3. ---------------------*/
4. else if($step==2)
5. {
6. include_once(DEDEADMIN."/makehtml_archives_action.php");
7. exit();
8. }
9. //更新主页
10. /*-------------------------
11. function _3_MakeHomePage()

Breadcrumbs

23:21:22

error_reporting	`mysqli_query() expects parameter 1 to be mysqli, string given`
line	6
code	2
file	/data/prvd/src/sink/sqli/001-mysqli_query.php

23:21:22

error_reporting	`Undefined offset: 1`
line	114
code	8
file	/var/www/html/include/dedesqli.class.php

23:21:22

error_reporting	`mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given`
line	393
code	2
file	/var/www/html/include/dedesqli.class.php

23:21:22

error_reporting	`Illegal string offset 'dd'`
line	69
code	2
file	/var/www/html/dede/makehtml_archives_action.php

23:21:22

error_reporting	`Uninitialized string offset: 0`
line	69
code	8
file	/var/www/html/dede/makehtml_archives_action.php

23:21:22

error_reporting	`A non-numeric value encountered`
line	80
code	2
file	/var/www/html/dede/makehtml_archives_action.php

23:21:22
message
SQL 注入

Formatted curl

GET/dede/makehtml_all.phplocalhost

查询字符串

action	make
mkvalue	1'"><xtanzi>./../xtanzi
step	2
uptype	id

Cookies

DedeLoginTime	1541688180
DedeLoginTime__ckMd5	e0aae65f320d5585
DedeUserID	1
DedeUserID__ckMd5	5ebcf2784562fcbb
ENV_GOBACK_URL	/dede/content_list.php
PHPSESSID	********
_csrf_name_36da6296	1922605a943b494197d1e2b8fb3185d0
_csrf_name_36da6296__ckMd5	a98b70f940a7e746
_csrf_name_5964670e	f134da46f0caa624080e75cf39f400bb
_csrf_name_5964670e__ckMd5	ce47e55d4480e8ab
menuitems	1_1,2_1,3_1,4_1,5_1

标头

Accept	text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding	gzip, deflate, br
Accept-Language	zh-CN,zh;q=0.9,en;q=0.8
Connection	keep-alive
Host	localhost:8080
Prvd-Fuzzer	halo_from_fate0
Referer	http://localhost:8080/dede/makehtml_all.php
Upgrade-Insecure-Requests	1
User-Agent	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36

User

Runtime

Name	php
Version	7.2.9

SDK

姓名	sentry-php
版本	1.9.2

Ownership Rules

Create Ownership Rule

All Environments

首次出现时间

时间:: 2 minutes ago
Nov 8, 2018 11:21:22 PM HKT
版本:: not configured

最后出现时间

时间:: 2 minutes ago
Nov 8, 2018 11:21:22 PM HKT
版本:: not configured

通知

由于已订阅工作流通知你正在接受该项目的更新。

bigfile_info	[]
dede_admin_channel	0
dede_admin_id	1
dede_admin_name	admin
dede_admin_purview	admin_AllowAll
dede_admin_style	newdedecms
dede_admin_type	10
file_info	[]
securimage_code_value	aq2t

dedecms

SQL 注入

问题 #

事件

用户

Assignee

172.17.0.1

Unknown Browser

php

标签

消息

Stacktrace(最近的调用最先显示)

GET/dede/makehtml_all.phplocalhost

查询字符串

Cookies

标头

User

Runtime

SDK

Ownership Rules

All Environments

最近 24 小时

最近 30 天

首次出现时间

最后出现时间

标签

level

logger

runtime

runtime.name

server_name

site

url

user

通知

link	Object mysqli
query	SELECT id FROM `dede_arctiny` WHERE id>=1\'\"><xtanzi>./../xtanzi AND arcrank=0 LIMIT 0,0

id	out
sql	SELECT id FROM `#@__arctiny` WHERE id>=1\'\"><xtanzi>./../xtanzi AND arcrank=0 LIMIT 0,0

dedecms

SQL 注入

问题 #

事件

用户

Assignee

事件 5b35bd52cbb643619a808e6b59fad2cc

172.17.0.1

Unknown Browser

php

标签

消息

Stacktrace(最近的调用最先显示)

Breadcrumbs

GET/dede/makehtml_all.phplocalhost

查询字符串

Cookies

标头

User

Runtime

SDK

Ownership Rules

All Environments

最近 24 小时

最近 30 天

首次出现时间

最后出现时间

标签

level

logger

runtime

runtime.name

server_name

site

url

user

通知