sycPHPCMS v1.6 cookie sqlinjection

./user/index.php

 include "../include/conn.php";
 include "../include/function.php";

 $Vipname=SafeRequest("name","get");
 $Vippwd=SafeRequest("pwd","get");
 $Viplogn=SafeRequest("logname","get");
 if(($Vipname=="")||($Vippwd=="")){
     if(empty($_COOKIE["S_Name"])||empty($_COOKIE["S_PWD"])){
         echo "<script>window.location='userlog.php'</script>";
         die();
     }
     else{
         $sql="select * from s_users where S_Name='".$_COOKIE["S_Name"]."'";
         $result=$db->query($sql);
         if($row=$db->fetch_array($result)){

 ......

用户名$_COOKIE['S_Name']未经过滤就入库查询了，产生了cookie注入。不过这个漏洞很鸡肋，因为系统默认关闭了用户注册功能，所以基本上，然并卵........