WooYun.org

member/flink_main.php
if($dopost=="addnew")
{
    AjaxHead();
    $row = $dsql->GetOne("SELECT COUNT(*) AS dd FROM `#@__member_flink` WHERE mid='".$cfg_ml->M_ID."' ");
    if($row['dd']>=50)
    {
        echo "<font color='red'>增加网址失败，因为已经达到五十个网址的上限！</font>";
        GetLinkList($dsql);
        exit();
    }
    if(!preg_match("#^http:\/\/#",$url)) $url = "http://".HtmlReplace($url, 2);//如果前面有http就不过滤了
    $title = HtmlReplace($title);
    $inquery = "INSERT INTO `#@__member_flink`(mid,title,url) VALUES(".$cfg_ml->M_ID.",'$title','$url'); ";//这不就注入了么
	echo $inquery ;
    $dsql->ExecuteNoneQuery($inquery);
    echo "<font color='red'>成功增加一链接！</font>";
    GetLinkList($dsql);
    exit();