ecshop的/admin/comment_manage.php中,对输入参数sort_by、sort_order未进行严格过滤,导致SQL注入。
打开admin/comment_manage.php中,约336行,
原代码:
$filter[‘sort_by’] = empty($_REQUEST[‘sort_by’]) ? ‘add_time’ : trim($_REQUEST[‘sort_by’]);
$filter[‘sort_order’] = empty($_REQUEST[‘sort_order’]) ? ‘DESC’ : trim($_REQUEST[‘sort_order’]);
替换为
$filter[‘sort_by’] = empty($_REQUEST[‘sort_by’]) ? ‘add_time’ : addslashes(trim($_REQUEST[‘sort_by’]));
$filter[‘sort_order’] = empty($_REQUEST[‘sort_order’]) ? ‘DESC’ : addslashes(trim($_REQUEST[‘sort_order’]));