WooYun.org

......//省掉前面无关代码
<%
	response.setHeader("Pragma","No-cache");
	response.setHeader("Cache-Control","no-cache");    
	response.setDateHeader("Expires", 0);
	int colId = Convert.getParameterInt(request, "i_colid", 0);
	int infoId = Convert.getParameterInt(request, "i_infoid", 0);
	String pltype = Convert.getParameter(request, "pltype", "",true,true);//这个类型很重要，决定带入那个方法体
	
	String strToPath = application.getRealPath("") + "/jcms_files/jcms" + strAppID+"/web"+strWebID+"/site/module/comment/";
	String strIniPath = strToPath +"config/init.xml";
	String strIpStyle = xmlFile.getContent("ipstyle", strIniPath);	
	int start = Convert.getParameterInt(request,"startrecord",1);
	int iPerPage = Convert.getParameterInt(request,"perpage",10);
	int groupsize = Convert.getParameterInt(request,"groupsize",8);
	String c_uuid = Convert.getParameter(request,"c_uuid","",true,true);
	int totalNum = 0;
	String strCommentStyle = "";
	
	String strKeywords = Convert.getParameter(request, "fn_Keywords", "");
	String strScope = Convert.getParameter(request, "fn_Scope");
	String strStartTime = Convert.getParameter(request, "starttime");
	String strEndTime = Convert.getParameter(request, "endtime");
	String strTpl_vc_Ip = Convert.getIp(request);		//获取IPd地址
	Jcms_Comment_InfoBLF commentBLF = new Jcms_Comment_InfoBLF(strAppID,strWebID);
	Jcms_Comment_InfoBLF blf = new Jcms_Comment_InfoBLF(strAppID,strWebID);
	ArrayList al = new ArrayList();
	if("Y".equals(pltype)) {//当pltype为Y时，走这里
		totalNum = blf.getTotalNum(strScope, strKeywords, colId, infoId, strStartTime, strEndTime);//这里进入getTotalNum(...)函数中	
		strCommentStyle = xmlFile.getContent("scriptcode", strIniPath);
		 // 原文
		al = blf.getEnt(strScope, strKeywords, colId, infoId, strStartTime, strEndTime, start, iPerPage+1);
	}
......

public int getTotalNum(String strScope, String strKeywords, int colId, int infoId, String strStartTime, String strEndTime)
  {
    StringBuffer sbSql = new StringBuffer(128);
    StringBuffer strConditionBuf = new StringBuffer(128);
    try {
      strScope = Convert.getValue(strScope);
      strKeywords = Convert.getValue(strKeywords);
      strStartTime = Convert.getValue(strStartTime);
      strEndTime = Convert.getValue(strEndTime);
      if (!strScope.equals("")) { ////strScope随意为下面中的一个，都能拼接进SQL语句，导致注入产生
        if (strScope.equalsIgnoreCase("vc_infoTitle"))
        {
          strConditionBuf.append(" AND vc_infotitle LIKE '%" + strKeywords + "%'");
        }
        if (strScope.equalsIgnoreCase("vc_author"))
        {
          strConditionBuf.append(" AND vc_author LIKE '%" + strKeywords + "%'");
        }
        if (strScope.equalsIgnoreCase("t_content"))
        {
          strConditionBuf.append(" AND t_content LIKE '%" + strKeywords + "%'");
        }
      }
      if ((strStartTime.length() > 0) && (strEndTime.length() > 0)) {
        strConditionBuf.append(" AND c_createtime >= '" + strStartTime + "'")
          .append(" AND c_createtime <= '" + strEndTime + "'");
      }
      else if ((strStartTime.length() > 0) && (strEndTime.length() == 0)) {
        strConditionBuf.append(" AND c_createtime >= '" + strStartTime + "'");
      }
      else if ((strStartTime.length() == 0) && (strEndTime.length() > 0)) {
        strConditionBuf.append(" AND c_createtime <= '" + strEndTime + "'");
      }
      sbSql.append("SELECT COUNT(i_id)")
        .append(" FROM jcms_comment_info")
        .append(" WHERE i_sid=0 AND b_ischeck=1")
        .append(" AND b_iscallback=0")
        .append(" AND i_columnid=").append(colId)
        .append(" AND i_infoid=").append(infoId)
        .append(strConditionBuf.toString());
      String[][] strData = Manager.doQuery(this.strAppID, sbSql.toString());
      if ((strData == null) || (strData.length == 0))
        return 0;
      return Convert.getStringValueInt(strData[0][0]);
    } catch (Exception e) {
      LogWriter.error("getEnt Error:" + e, Jcms_Comment_InfoBLF.class);
      return 0;
    } finally {
      if ((sbSql != null) && (sbSql.length() > 0)) {
        sbSql.delete(0, sbSql.length());
      }
      if ((strConditionBuf != null) && (strConditionBuf.length() > 0))
        strConditionBuf.delete(0, strConditionBuf.length());
    }
  }