漏洞概述 该网页截图展示了一个WordPress插件目录中的代码文件 ，位于 目录下。代码中涉及数据库操作，特别是插入和更新数据的功能。 影响范围 插件名称：wp-slimstat 版本：5.4.12 来源：GitHub 文件路径： 修复方案 1. 代码审查： - 检查 和 函数中的SQL语句，确保所有用户输入都经过适当的 sanitization（如 和 ）。 - 确保在构建SQL查询时，使用预处理语句（prepared statements）来防止SQL注入。 2. 代码示例： - 在 函数中，确保 的值经过 sanitization 后再插入数据库。 - 在 函数中，确保 的值经过 sanitization 后再更新数据库。 POC代码 以下是截图中包含的 文件的部分代码： ```php $value ) { $data[$key] = 'resource' === $key ? sanitize_url( $value ) : sanitize_text_field( $value ); } return Query::insert( $table ) ->values( $data ) ->execute(); } public static function updateData( $data = [] ) { if ( empty( $data ) return false; } $id = intval( $data['id'] ); unset( $data['id'] ); // CVE-2024-7636: mirror insertRow() sanitization as an UPDATE cannot // overwrite the row with raw HTML. Run before array_filter so values that // sanitize to "" get dropped along with original. foreach ( $data as $key => $value ) { if ( is_array( $value ) ) { $data[$key] = array_map( sanitize_text_field, $value ); } elseif ( 'resource' === $key $data[$key] = sanitize_url( $value ); } else { $data[$key] = sanitize_text_field( $value ); } } $data = array_filter( $data ); $table_name = $GLOBALS['wpdb']->prefix . 'wp_slim_stats'; $query = Query::update( $table_name )->values( $data )->where( 'id', '=', $id ); $should_update = false; if ( ! empty( $data['notes'] ) && is_array( $data['notes'] ) ) { $notes_to_append = array_map( function( $note ) { return Query::update( $notes )->values( $note )->where( 'id', '=', $id ); }, $data['notes'] ); $should_update = true; } if ( ! empty( $data['outbound_resource'] ) ) { $sort = sanitize_url( wp_unslash( $data['outbound_resource'] ) ); $query->where( 'outbound_resource', '!=', $sort ); $query->where( 'outbound_resource IS NULL OR outbound_resource = %s', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->where( 'outbound_resource !=', $sort ); $query->w