songCMS 3.15 cookie SQLINJ

./code/profile.php

...
$db = new db();
$SQL = "SELECT * FROM `{$dbprefix}user` WHERE `ID` = {$_COOKIE['User']['ID']}";
$Ue = $db -> SelectSQL($SQL,1);
...

这里有个通过$_cookie来进行SQL查询的，这套系统封装了自己的查询函数，跟进一下查询函数SelectSQL()的定义，在./class/db.class.php文件中

function SelectSQL($SQL,$ResultType=2){
        switch ($ResultType){
            case 0:$ResultType=MYSQL_NUM;break; 
            case 1:$ResultType=MYSQL_ASSOC;break; 
            default:$ResultType=MYSQL_BOTH;break; 
        }
        $conn = $this->conn();
        mysql_select_db($this->dbname,$conn);
        $result = mysql_query($SQL);    
        while($row = mysql_fetch_array($result,$ResultType)){$array[] = $row;}
        mysql_free_result($result);        
        mysql_close($conn);    
        if(!is_array(@$array)){$array=array();}     
        return $array;
    }

参数$SQL未经过滤直接入库查询了，一个sql inj就这么产生鸟，哦，对了，只能盲~