| शीर्षक | wuzhicms <=4.1.0 SQL Injection |
|---|
| विवरण | article::getDataOfJson() reads the request body directly from php://input and json_decodes it. The title field in the JSON body is never passed through the framework's standard filtering functions input()/sql_replace() and is concatenated directly into the SQL string literal `title`='$title'; the master_table field likewise overrides the query's target table without any validation, and is concatenated into the backtick-quoted table-name position. The underlying WUZHI_mysqli::get_one() performs no escaping or parameterization on either the concatenated $where clause or the $table name, and query() executes mysqli_query() raw. Because this request travels via the JSON body input path, it completely bypasses the sql_replace() filter chain that the framework uses to strip quotes/semicolons/comment markers (that chain only applies to values read via input() from $_GET/$_POST). As a result, both the single quote ' and the backtick ` reach the SQL concatenation point unmodified, producing both a classic string injection and a more severe identifier (table-name) injection. |
|---|
| स्रोत | ⚠️ https://github.com/wuzhicms/wuzhicms/issues/218 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 17/08/2026 07:20 AM (30 दिन पहले) |
|---|
| संयम | 15/09/2026 10:44 AM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 404076 [WuzhiCMS तक 4.1.0 index.php?m=content&f=article&v=getDataOfJson article::getDataOfJson title/master_table SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|