去官网下载了最新版本并打上了最新补丁后审计出来几处漏洞。先提交2个gpc=off的注射，该程序还有getshell看看厂商的态度再考虑发不发。

1.cp_profile.php
 

//隐私
$inserts = array();
foreach ($_POST['friend'] as $key => $value) {
    $value = intval($value);
    $inserts[] = "('base','$key','$space[uid]','$value')";
}
if($inserts) {
    $_SGLOBAL['db']->query("DELETE FROM ".tname('spaceinfo')." WHERE uid='$space[uid]' AND type='base'");
    $_SGLOBAL['db']->query("INSERT INTO ".tname('spaceinfo')." (type,subtype,uid,friend)
        VALUES ".implode(',', $inserts));
}

key未过滤即带入数据库造成注射。

第二处注入：cp_privacy.php

foreach ($filter_note as $key => $value) {
list($type, $uid) = explode('|', $key);
$types[$key] = $type;
$uids[$key] = $uid;
if(is_numeric($type)) {
$appids[$key] = $type;
}
}
if($uids) {
$query = $_SGLOBAL['db']->query("SELECT uid, username FROM ".tname('space')." WHERE uid IN (".simplode($uids).")");
while ($value = $_SGLOBAL['db']->fetch_array($query)) {
$users[$value['uid']] = $value['username'];
}
}

一样是key未做过滤。



案例1证明：
 

案例2证明:
 

修复方案：

key也过滤下