| शीर्षक | wuzhicms <=4.1.0 SQL Injection |
|---|
| विवरण | In the admin-panel "content source" (copyfrom) management feature copyfrom::listing(), the keywords parameter is injected into $GLOBALS['keywords'] via the framework's set_globals() variable-overwrite mechanism, and is concatenated directly into the string literal `name` LIKE '%$keywords%' without passing through sql_replace() or any other filtering, before being passed to get_list(). The database abstraction layer's array2sql() strips only the %20/%27 encoded forms from a string-typed $where clause and does nothing to raw single-quote characters ', allowing an attacker to close the LIKE literal directly with a single quote and append arbitrary SQL. This controller, copyfrom, defines its own custom constructor and never calls the parent's parent::__construct(); authentication is instead enforced by WUZHI_admin::logs() at method-invocation time (super-admin accounts, flagged with ,1, in their role string, are allowed through). |
|---|
| स्रोत | ⚠️ https://github.com/wuzhicms/wuzhicms/issues/220 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 18/08/2026 12:06 PM (30 दिन पहले) |
|---|
| संयम | 16/09/2026 09:21 AM (29 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 250342 [wuzhicms 4.1.0 /core/admin/copyfrom.php keywords SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|