标签:
ecshop最新SQL注入漏洞,出现在后台管理,涉及到的文件有 includes/modules/payment/alipay.php,api/client/includes/lib_api.php,admin/edit_languages.php 注入漏洞
影响到所有包括ecshop,大小京东,大小商创程序以ecshop为内核的程序
到目前为止,ecshop官网还未做修复。
1.alipay.php 修复方法(约180行)
查找
1
|
$order_sn = trim( $order_sn ); |
修改为:
1
|
$order_sn = trim( addslashes ( $order_sn )); //安全过滤 by uuecs.com |
2. lib_api.php 修复方法(约247行)
查找
1
2
|
function API_UserLogin( $post ) { |
修改为
1
2
|
function API_UserLogin( $post ) { if (get_magic_quotes_gpc()) { $post [ ‘UserId‘ ] = $post [ ‘UserId‘ ] } else { $post [ ‘UserId‘ ] = addslashes ( $post [ ‘UserId‘ ]); } //安全过滤 by uuecs.com |
注意位置,别修改错了
3. admin/edit_languages.php修复方法(大概在第120行)
查找
1
|
$dst_items [ $i ] = $_POST [ ‘item_id‘ ][ $i ] . ‘ = ‘ . ‘"‘ . $_POST [ ‘item_content‘ ][ $i ]. ‘";‘ ; |
修改为:
1
|
$dst_items [ $i ] = $_POST [ ‘item_id‘ ][ $i ] . ‘ = ‘ . ‘\‘‘ . $_POST [ ‘item_content‘ ][ $i ]. ‘\‘;‘ ; //双引号改为单引号 by uuecs.com |
标签:
原文地址:http://www.cnblogs.com/uuecshop/p/ecshop.html