taocms3.0.2 SQL injection exists in the background

[zhendezuile]

Vulnerability file address:
\include\Model\Category.php

It can be seen that the update function does not filter the id. After obtaining the id with the columnsdata function, it is brought into the updatelist function to update the data.

Then bring the id into the getlist function for the select query

Finally, the id is brought into the updatelist function for an update
As can be seen from the above, a total of three SQL statements were executed, and none of the ids were filtered.

Vulnerability to reproduce:
1、Build the environment locally, and then enter the background
2、Click the Manage section, then click Edit, and finally click Submit


3、Then use burpsuite to capture a packet and send the packet to the repeater module

4、The vulnerability variable is id, and the payload is constructed as: and if(ascii(substr(database(),1,1))=116,sleep(2),0)
Click send, you can see that the successful delay is 6 seconds，as mentioned earlier, this is because the SQL statement is executed 3 times

Repair suggestion:
filter by id