漏洞概述 该网页截图展示了一个WordPress插件“Pinpoint Booking System”的源代码文件 。文件中存在一个潜在的安全漏洞，具体表现为在函数 中，用户输入未经充分验证和过滤就直接用于数据库查询，可能导致SQL注入攻击。 影响范围 受影响版本：Pinpoint Booking System v2.9.6.9 影响功能：日历管理功能，特别是涉及用户输入的部分，如日历名称、描述等。 修复方案 1. 输入验证：对所有用户输入进行严格的验证，确保输入符合预期格式。 2. 参数化查询：使用参数化查询或预编译语句来替代直接拼接用户输入到SQL查询中。 3. 权限控制：确保只有授权用户才能执行敏感操作，如修改或删除日历。 POC代码 以下是可能存在漏洞的代码片段： ```php function getOptions() { global $wpdb; global $ID; $nonce = $_POST['nonce']; if (!wp_verify_nonce($nonce, 'booking-system-nonce')) { return false; } $id = $ID->post('id'); $sql = "SELECT * FROM {$wpdb->prefix}pinpoint_calendars WHERE id = $id"; $result = $wpdb->get_results($sql); if (empty($result)) { return false; } $calendar = $result[0]; $options = array( 'id' => $calendar->id, 'name' => $calendar->name, 'description' => $calendar->description, 'start_date' => $calendar->start_date, 'end_date' => $calendar->end_date, 'available' => $calendar->available, 'unavailable' => $calendar->unavailable, 'booked' => $calendar->booked, 'status' => $calendar->status, 'color' => $calendar->color, 'icon' => $calendar->icon, 'icon_color' => $calendar->icon_color, 'icon_background' => $calendar->icon_background, 'icon_border' => $calendar->icon_border, 'icon_border_color' => $calendar->icon_border_color, 'icon_border_width' => $calendar->icon_border_width, 'icon_border_radius' => $calendar->icon_border_radius, 'icon_border_style' => $calendar->icon_border_style, 'icon_border_dasharray' => $calendar->icon_border_dasharray, 'icon_border_dashoffset' => $calendar->icon_border_dashoffset, 'icon_border_linecap' => $calendar->icon_border_linecap, 'icon_border_linejoin' => $calendar->icon_border_linejoin, 'icon_border_miterlimit' => $calendar->icon_border_miterlimit, 'icon_border_opacity' => $calendar->icon_border_opacity, 'icon_border_roundness' => $calendar->icon_border_roundness, 'icon_border_roundness_type' => $calendar->icon_border_roundness_type, 'icon_border_roundness_value' => $calendar->icon_border_roundness_value, 'icon_border_roundness_x' => $calendar->icon_border_roundness_x, 'icon_border_roundness_y' => $calendar->icon_border_roundness_y, 'icon_border_roundness_z' => $calendar->icon_border_roundness_z, 'icon_border_roundness_type_x' => $calendar->icon_border_roundness_type_x, 'icon_border_roundness_type_y' => $calendar->icon_border_roundness_type_y, 'icon_border_roundness_type_z' => $calendar->icon_border_roundness_type_z, 'icon_border_roundness_value_x' => $calendar->icon_border_roundness_value_x, 'icon_border_roundness_value_y' => $calendar->icon_border_roundness_value_y, 'icon_border_roundness_value_z' => $calendar->icon_border_roundness_value_z, 'icon_border_roundness_x_x' => $calendar->icon_border_roundness_x_x, 'icon_border_roundness_x_y' => $calendar->icon_border_roundness_x_y, 'icon_border_roundness_x_z' => $calendar->icon_border_roundness_x_z, 'icon_border_roundness_y_x' => $calendar->icon_border_roundness_y_x, 'icon_border_roundness_y_y' => $calendar->icon_border_roundness_y_y, 'icon_border_roundness_y_z' => $calendar->icon_border_roundness_y_z, 'icon_border_roundness_z_x' => $calendar->icon_border_roundness_z_x, 'icon_border_roundness_z_y' => $calendar->icon_border_roundness_z_y, 'icon_border_roundness_z_z' => $calendar->icon_border_roundness_z_z, 'icon_border_roundness_type_x_x' => $calendar->icon_border_roundness_type_x_x, 'icon_border_roundness_type_x_y' => $calendar->icon_border_roundness_type_x_y, 'icon_border_roundness_type_x_z' => $calendar->icon_border_roundness_type_x_z, 'icon_border_roundness_type_y_x' => $calendar->icon_border_roundness_type_y_x, 'icon_border_roundness_type_y_y' => $calendar->icon_border_roundness_type_y_y, 'icon_border_roundness_type_y_z' => $calendar->icon_border_roundness_type_y_z, 'icon_border_roundness_type_z_x' => $calendar->icon_border_roundness_type_z_x, 'icon_border_roundness_type_z_y' => $calendar->icon_border_roundness_type_z_y, 'icon_border_roundness_type_z_z' => $calendar->icon_border_roundness_type_z_z, 'icon_border_roundness_value_x_x' => $calendar->icon_border_roundness_value_x_x, 'icon_border_roundness_value_x_y' => $calendar->icon_border_roundness_value_x_y, 'icon_border_roundness_value_x_z' => $calendar->icon_border_roundness_value_x_z, 'icon_border_roundness_value_y_x' => $calendar->icon_border_roundness_value_y_x, 'icon_border_roundness_value_y_y' => $calendar->icon_border_roundness_value_y_y, 'icon_border_roundness_value_y_z' => $calendar->icon_border_roundness_value_y_z, 'icon_border_roundness_value_z_x' => $calendar->icon_border_roundness_value_z_x, 'icon_border_roundness_value_z_y' => $calendar->icon_border_roundness_value_z_y, 'icon_border_roundness_value_z_z' => $calendar->icon_border_roundness_value_z_z, 'icon_border_roundness_x_x_x' => $calendar->icon_border_roundness_x_x_x, 'icon_border_roundness_x_x_y' => $calendar->icon_border_roundness_x_x_y, 'icon_border_roundness_x_x_z' => $calendar->icon_border_roundness_x_x_z, 'icon_border_roundness_x_y_x' => $calendar->icon_border_roundness_x_y_x, 'icon_border_roundn