XOOPS程序banners.php文件中的代码存在错误，允许未经授权的用户重定义本地变量并注入SQL命令：
<?

[...]

function EmailStats($login, $cid, $bid, $pass)
{
global $xoopsDB, $xoopsConfig;
$result2 = $xoopsDB->query("select name, email from
".$xoopsDB->prefix("bannerclient")." where cid=$cid");
list($name, $email) = $xoopsDB->fetchRow($result2);
if ( $email == "" ) {
redirect_header("banners.php",3,"There isn't an email associated with
client ".$name.".<br />Please contact the Administrator");

exit();
} else {
$result = $xoopsDB->query("select bid, imptotal, impmade, clicks,
imageurl, clickurl, date from ".$xoopsDB->prefix("banner")." where bid=$bid
and cid=$cid");
list($bid, $imptotal, $impmade, $clicks, $imageurl, $clickurl, $date) =
$xoopsDB->fetchRow($result);
[...]

$fecha = date("F jS Y, h:iA.");
$subject = "Your Banner Statistics at ".$xoopsConfig[sitename]."";
$message = "Following are the complete stats for your advertising
investment at ". $xoopsConfig['sitename']." :\n\n\nClient Name:
$name\nBanner ID: $bid\nBanner Image: $imageurl\nBanner URL:
$clickurl\n\nImpressions Purchased: $imptotal\nImpressions Made:
$impmade\nImpressions Left: $left\nClicks Received: $clicks\nClicks Percent:
$percent%\n\n\nReport Generated on: $fecha";
$xoopsMailer =& getMailer();
$xoopsMailer->useMail();
$xoopsMailer->setToEmails($email);
$xoopsMailer->setFromEmail($xoopsConfig['adminmail']);
$xoopsMailer->setFromName($xoopsConfig['sitename']);
$xoopsMailer->setSubject($subject);
$xoopsMailer->setBody($message);
$xoopsMailer->send();
redirect_header("banners.php?op=Ok&login=$login&pass=$pass",3,"Stati
stics
for your banner has been sent to your email address.");
//include "footer.php";
exit();
}
}

function change_banner_url_by_client($login, $pass, $cid, $bid, $url)
{
global $xoopsDB;
$result = $xoopsDB->query("select passwd from
".$xoopsDB->prefix("bannerclient")." where cid=".$cid."");
list($passwd) = $xoopsDB->fetchRow($result);
if ( $pass == $passwd ) {
$xoopsDB->queryF("update ".$xoopsDB->prefix("banner")." set
clickurl='".$url."' where bid=".$bid."");
}
redirect_header("banners.php?op=Ok&login=$login&pass=$pass",3,"URL
has been changed.");
//include "footer.php";
exit();
}

[...]

switch ( $op ) {
case "Change":
change_banner_url_by_client($login, $pass, $cid, $bid, $url);
break;
case "EmailStats":
EmailStats($login, $cid, $bid, $pass);
break;
[...]
}

?>

攻击者通通过向目标服务器提交精心构造的下列格式的URL请求能触发该缺陷：
http://[target]/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20'a%'/*

攻击方法：
示例代码：
http://[target]/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20'a%'/*

解决方案：
用下列代码替换banners.php文件中的change_banner_url_by_client()函数：
function change_banner_url_by_client($login, $pass, $cid, $bid, $url)
{
global $xoopsDB;
if ( !empty($cid) AND !empty($bid) AND !empty($pass) ){
$result = $xoopsDB->query("select passwd from
".$xoopsDB->prefix("bannerclient")." where cid='".$cid."'");
list($passwd) = $xoopsDB->fetchRow($result);
if ( $pass == $passwd ) {
$xoopsDB->queryF("update ".$xoopsDB->prefix("banner")." set
clickurl='".$url."' where bid='".$bid."'");
}
redirect_header("banners.php?op=Ok&login=$login&pass=$pass",3,"URL
has been changed.");
//include "footer.php";
}
exit();
}

在“switch($op) {”前添加下列代码：
$cid = intval($cid);
$bid = intval($bid);