WooYun.org

大概在69行时，判断$id为整形，后续有调用$_GET[‘id’]，执行删除操作，导致了sql注入。
if (isset($_GET['do']) || isset($_GET['act'])) {
	$do = trim($_GET['do']);
	$action = null;
	if(isset($_GET['action'])) $action = trim($_GET['action']);
	if (isset($_GET['id'])) {
		$id = intval($_GET['id']);
	}
.....	
if (($do == "del" || $_GET['act']=="del") && !empty($id)) {
		
		$res = $product->read("id",$id);
		if($res){
			if(!$product->del($_GET['id'], $conditions)){
				flash();
			}
		}else {
			flash("data_not_exists");;
		}
	}	
}

function del($ids, $conditions = null, $table = null)
	{
		$del_id = $this->primaryKey;
		$tmp_ids = $condition = null;
		if (is_array($ids))
		{
			$tmp_ids = implode(",",$ids);
			$cond[] = "{$del_id} IN ({$tmp_ids})";
			$this->catchIds = serialize($ids);
		}
		else
		{
			$cond[] = "{$del_id}=".intval($ids);
			$this->catchIds = $ids;
		}
		if (!empty($table)) {
			$table_name = $this->table_prefix.$table;
		}else{
			$table_name = $this->getTable();
		}
		if(!empty($conditions)) {
			if(is_array($conditions)) {
				$tmp_where_cond = implode(" AND ", $conditions);
				$cond[] = $tmp_where_cond;
			}
			else {
				$cond[] = $conditions;
			}
		}
		$this->setCondition($cond);
		$sql = "DELETE FROM ".$table_name.$this->getCondition(); echo $sql;exit;
		$deleted = $this->dbstuff->Execute($sql);
		unset($this->condition);
		return $deleted;
	}