DedeCms 会员中心注入漏洞

member/buy_action.php

require_once(dirname(__FILE__)."/config.php");

CheckRank(0,0);

$menutype = 'mydede';

$menutype_son = 'op';

require_once DEDEINC.'/dedetemplate.class.php';



$product = isset($product) ? trim($product) : '';

$mid = $cfg_ml->M_ID;

$ptype = '';

$pname = '';

$price = '';

$mtime = time();

省略XX行

if(empty($product))

{

    ShowMsg("请选择一个产品!", 'javascript:;');

    exit();

}

省略xxx行

=if(!isset($paytype))

{    

    $inquery = "INSERT INTO #@__member_operation(`buyid` , `pname` , `product` , `money` , `mtime` , `pid` , `mid` , `sta` ,`oldinfo`)

   VALUES ('$buyid', '$pname', '$product' , '$price' , '$mtime' , '$pid' , '$mid' , '0' , '$ptype');//product没有过滤

    ";

        echo  $inquery."<br>" ;