首页 > 代码库 > ECSHOP /api/client/includes/lib_api.php

ECSHOP /api/client/includes/lib_api.php

 

ecshop /api/client/api.php、/api/client/includes/lib_api.php

 

ECShop存在一个盲注漏洞,问题存在于/api/client/api.php文件中,提交特制的恶意POST请求可进行SQL注入攻击,可获得敏感信息或操作数据库。

 

参照以下修改:

function API_UserLogin($post){    /* SQL注入过滤 */    if (get_magic_quotes_gpc())     {             $post[‘UserId‘] = $post[‘UserId‘]         }     else     {             $post[‘UserId‘] = addslashes($post[‘UserId‘]);         }    /* end */    $post[username] = isset($post[UserId]) ? trim($post[UserId]) : ‘‘;

 

ECSHOP /api/client/includes/lib_api.php