漏洞页面：member/post.php
 
<?php
define("ROOTPATH", "../");
include(ROOTPATH."includes/common.inc.php");
include("language/".$sLan.".php");
include(ROOTPATH."member/includes/member.inc.php");
 
 
$act = $_POST['act'];
 
switch($act){
...略
 
        //读取头像
        case "loadface":
                SecureMember();
                $memberid=$_COOKIE["MEMBERID"];
 
                $fsql->query("select nowface from {P}_member where memberid='$memberid'");//这里触发sql注入漏洞 如1'and '1'='1
                if($fsql->next_record()){
                        $nowface=$fsql->f('nowface');
                }
                echo $nowface;
                exit;
 
        break;
}
转自：http://www.90sec.org/thread-1865-1-1.html

www.2cto.com提供修复

加强过滤