songCMS 3.15 cookie SQLINJ

./code/profile.php

...
$db = new db();
$SQL = "SELECT * FROM `{$dbprefix}user` WHERE `ID` = {$_COOKIE['User']['ID']}";
$Ue = $db -> SelectSQL($SQL,1);
...

这里有个通过$_cookie来进行SQL查询的，这套系统封装了自己的查询函数，跟进一下查询函数SelectSQL()的定义，在./class/db.class.php文件中

 function SelectSQL($SQL,$ResultType=2){
         switch ($ResultType){
             case 0:$ResultType=MYSQL_NUM;break;
             case 1:$ResultType=MYSQL_ASSOC;break;
             default:$ResultType=MYSQL_BOTH;break;
         }
         $conn = $this->conn();
         mysql_select_db($this->dbname,$conn);
         $result = mysql_query($SQL);
         while($row = mysql_fetch_array($result,$ResultType)){$array[] = $row;}
         mysql_free_result($result);
         mysql_close($conn);
         if(!is_array(@$array)){$array=array();}
         return $array;
     }

参数$SQL未经过滤直接入库查询了，一个sql inj就这么产生鸟，哦，对了，只能盲~