MKCMS v6.2 /ucenter/reg.php前台sql注入漏洞¶
一、漏洞简介¶
二、漏洞影响¶
MKCMS v6.2
三、复现过程¶
/ucenter/reg.php的name参数，存在注入
/ucenter/reg.php
<?php
...
if(isset($_POST['submit'])){
$username = stripslashes(trim($_POST['name']));
// 检测用户名是否存在
$query = mysql_query("select u_id from mkcms_user where u_name='$username'");
...