重要更新:Youbbs发现SQL注入漏洞
存在问题的版本: v1.04,v2.0
v1.04把:
// 获取当前用户
$cur_user = null;
$cur_uid = $_COOKIE['cur_uid'];
$cur_uname = $_COOKIE['cur_uname'];
$cur_ucode = $_COOKIE['cur_ucode'];
替换为:
// 获取当前用户
$cur_user = null;
$cur_uid = isset($_COOKIE['cur_uid']) ? intval($_COOKIE['cur_uid']) : '';
$cur_uname = isset($_COOKIE['cur_uname']) ? $_COOKIE['cur_uname'] : '';
$cur_ucode = isset($_COOKIE['cur_ucode']) ? $_COOKIE['cur_ucode'] : '';
v2.0把:
// 获取当前用户
$cur_user = null;
$cur_uid = isset($_COOKIE['cur_uid']) ? $_COOKIE['cur_uid'] : '';
$cur_uname = isset($_COOKIE['cur_uname']) ? $_COOKIE['cur_uname'] : '';
$cur_ucode = isset($_COOKIE['cur_ucode']) ? $_COOKIE['cur_ucode'] : '';
替换为:
// 获取当前用户
$cur_user = null;
$cur_uid = isset($_COOKIE['cur_uid']) ? intval($_COOKIE['cur_uid']) : '';
$cur_uname = isset($_COOKIE['cur_uname']) ? $_COOKIE['cur_uname'] : '';
$cur_ucode = isset($_COOKIE['cur_ucode']) ? $_COOKIE['cur_ucode'] : '';
漏洞截图: