cscms v4.1 allows for SQL injection via the "js_del" function.
cpe:2.3:a:chshcms:cscms:4.1:*:*:*:*:*:*:*
1DCFB098-04A8-43FE-AF93-0BE46815BAA3
OR
## 1.Vulnerability summary
Vulnerability name：Cscms V4.1 has sqlinjection vulnerabilities
Report date: 2020-10-26
Product Home: http://www.chshcms.com/down.html
Software link:http://www.chshcms.com/down.html
Version:v4.1

## 2.Vulnerability overview
Vulnerability file:cscms4.1\plugins\sys\admin\label.php 197 lines-219 lines
Vulnerability function：js_del
Vulnerability param:id 

public function js_del(){
        $id = $this->input->get_post('id');
		if(empty($id)) getjson(L('plub_04'));
		//删除文件
		if(is_array($id)){
		   foreach ($id as $ids) {
			    $row=$this->db->query("SELECT js FROM ".CS_SqlPrefix."ads where id='".$ids."'")->row();
			    if($row){
                    $jsurl='.'.Web_Path.'attachment/js/'.$row->js.'.js';
			        @unlink($jsurl);
			    }
		   }
		}else{
			    $row=$this->db->query("SELECT js FROM ".CS_SqlPrefix."ads where id='".$id."'")->row();
			    if($row){
                    $jsurl='.'.Web_Path.'attachment/js/'.$row->js.'.js';
			        @unlink($jsurl);
			    }
		}
		$this->Csdb->get_del('ads',$id);
        $info['url'] = site_url('label/js').'?v='.rand(1000,9999);
        getjson($info,0);
	}

### 3.vulnerability exploitation
sql injection type：timebased-sqlinjection
wrong answer:
![图片](https://user-images.githubusercontent.com/53395980/97143465-b4780180-179d-11eb-89f4-243f2092516d.png)
right answer:
![图片](https://user-images.githubusercontent.com/53395980/97143444-a88c3f80-179d-11eb-9191-8bf30b1d5ba0.png)



Cscms V4.1 has sqlinjection vulnerability(2)
This is a GitHub Issue
repo:cscms
owner:chshcms
Title : Cscms V4.1 has sqlinjection vulnerability(2)
Issue date:

--- start body ---
## 1.Vulnerability summary
Vulnerability name：Cscms V4.1 has sqlinjection vulnerabilities
Report date: 2020-10-26
Product Home: http://www.chshcms.com/down.html
Software link:http://www.chshcms.com/down.html
Version:v4.1

## 2.Vulnerability overview
Vulnerability file:cscms4.1\plugins\sys\admin\label.php 197 lines-219 lines
Vulnerability function：js_del
Vulnerability param:id 

public function js_del(){
        $id = $this->input->get_post('id');
		if(empty($id)) getjson(L('plub_04'));
		//删除文件
		if(is_array($id)){
		   foreach ($id as $ids) {
			    $row=$this->db->query("SELECT js FROM ".CS_SqlPrefix."ads where id='".$ids."'")->row();
			    if($row){
                    $jsurl='.'.Web_Path.'attachment/js/'.$row->js.'.js';
			        @unlink($jsurl);
			    }
		   }
		}else{
			    $row=$this->db->query("SELECT js FROM ".CS_SqlPrefix."ads where id='".$id."'")->row();
			    if($row){
                    $jsurl='.'.Web_Path.'attachment/js/'.$row->js.'.js';
			        @unlink($jsurl);
			    }
		}
		$this->Csdb->get_del('ads',$id);
        $info['url'] = site_url('label/js').'?v='.rand(1000,9999);
        getjson($info,0);
	}

### 3.vulnerability exploitation
sql injection type：timebased-sqlinjection
wrong answer:
![图片](https://user-images.githubusercontent.com/53395980/97143465-b4780180-179d-11eb-89f4-243f2092516d.png)
right answer:
![图片](https://user-images.githubusercontent.com/53395980/97143444-a88c3f80-179d-11eb-9191-8bf30b1d5ba0.png)



--- end body ---

comments :
--- start comments ---

--- end comments ---