youBBS
YB站长

重要更新：Youbbs发现SQL注入漏洞

By brady at 2015-07-10 15:28 • 2604次点击

存在问题的版本： v1.04，v2.0

v1.04把：

$cur_user = null;
$cur_uid = $_COOKIE['cur_uid'];
$cur_uname = $_COOKIE['cur_uname'];
$cur_ucode = $_COOKIE['cur_ucode'];```
替换为：

// 获取当前用户 $cur_user = null; $cur_uid = isset($_COOKIE['cur_uid']) ? intval($_COOKIE['cur_uid']) : ''; $cur_uname = isset($_COOKIE['cur_uname']) ? $_COOKIE['cur_uname'] : ''; $cur_ucode = isset($_COOKIE['cur_ucode']) ? $_COOKIE['cur_ucode'] : '';```

v2.0把：

$cur_user = null;
$cur_uid = isset($_COOKIE['cur_uid']) ? $_COOKIE['cur_uid'] : '';
$cur_uname = isset($_COOKIE['cur_uname']) ? $_COOKIE['cur_uname'] : '';
$cur_ucode = isset($_COOKIE['cur_ucode']) ? $_COOKIE['cur_ucode'] : '';```
替换为：

漏洞截图：