SESSION variable override leads to SQL injection vulnerability

include/common.inc.php file, search (about 68 lines)

   if( strlen($svar)>0 && preg_match('#^(cfg_|GLOBALS|_GET|_POST|_COOKIE)#',$svar) )
      修改为
      if( strlen($svar)>0 && preg_match('#^(cfg_|GLOBALS|_GET|_POST|_COOKIE|_SESSION)#',$svar) )

Guess you like

Origin http://43.154.161.224:23101/article/api/json?id=326529207&siteId=291194637