程序名稱：Cmsez Web Content Manage System v2.0.0

文件：comments.php viewimg.php

代碼：

---------------

//comments

include "mainfile.php";

$art=new article();

//設(shè)定

$confirm='yes';//yes:需要管理員認(rèn)證后才能顯示,no:直接顯示

$member=new member();

$user_info=$member->member_auth();

$ulevel=$user_info[user_level];

########設(shè)置#############

$action = $_REQUEST[action];

$page="10";//

$need_user = "0";//

$id = $_REQUEST[id];// //對(duì)ID參數(shù)完全沒過濾

$fdb = $PlusDB->prefix(forum);//評(píng)論的數(shù)據(jù)庫

switch($action){

case "showNum":

$sql="select count(*) as num from ".$fdb." where post_aid='$id'";

$showNum=$PlusDB->getone($sql);

echo "

function comment(id)

{

var page = \"".PLUS_URL."/comments.php?id=\" + id ;

popwin = window.open(page,\"\",\"width=460,height=500,scrollbars,resizable\")

popwin.focus();

}

document.open();

document.write(\"\");

document.close();";

break;

case "saveComment":

--------------

viewimg.php

--------------

//image.php 顯示附件的圖片

include "mainfile.php";

$member=new member();

$confirm==false;//true 會(huì)員才能看,false 都能看

$user_info = $member->member_auth();

if($user_info[user_level]=="Guest" && $confirm==true){

include "modules/member/index.php";

}else{

$imgdb = $PlusDB->prefix(images);

$id=$_GET[id]; //米過濾,為什么他要直接獲得啊!

$aid = $_GET[aid]; //難道趕著吃晚飯?

$sql="select id from $imgdb where aid=$aid order by id ";

---------------------

exp:

allinurl:"owered by CMSEZ" comments.php inurlowered by CMSEZ

*

-------------------

修復(fù)方案:

最好把站關(guān)了...

總結(jié)

以上是生活随笔為你收集整理的inur new.php id,Cmsez(随易)全站系统 0day的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。