author:冰的原点

from http://www.0kee.com 零客网络安全小组

说明：利用和分析请见黑手0812期文章，嘿嘿这里只发代码了！


漏洞文件发生在：company/search.php第13行起：
$areaid = intval($areaid);
$areaid2 = intval($areaid2);
$sectorid = intval($sectorid);
$sectorid2 = intval($sectorid2);
$page = intval($page);

isset($comname) || $comname = '';
$comname = trim($comname);

看最后一行，只过滤了空格，我们接着往下看，看一下这个是怎么处理的。来到文件的122行：
if($comname != ''){
$wheresql .= " and comname LIKE '%".$comname."%'";
}

$wheresql = trim($wheresql);
if(eregi("^and", $wheresql)) {
$wheresql = substr($wheresql,3);
}
if($wheresql != ''){
$wheresql = 'where '.trim($wheresql);
}

$companys = array();
$query = "select id, comname, regyear, areaid, areaid2, service, typeid1, typeid2, comaddr, website, postid
from #@__member_cominfo $wheresql";

宽字符漏洞，嘿嘿！看黑手去吧