問(wèn)題說(shuō)明：

使用SQLMAP進(jìn)行測(cè)試

文件/public/install/index.php，代碼第321行account參數(shù)存在SQL注入漏洞

修改文件/public/install/index.php

 $res = false;
 try {
    $username = clean($username);
    $addadminsql = "INSERT INTO `{$dbPrefix}system_admin` (`account`, `pwd`, `real_name`, `roles`, `last_ip`, `last_time`, `add_time`, `login_count`, `level`, `status`, `is_del`) VALUES
    ('" . $username . "', '" . $password . "', 'admin', '1', '" . $ip . "',$time , $time, 0, 0, 1, 0)";
    $res = mysqli_query($conn, $addadminsql);
 } catch (\Exception $e) {
   echo $e->getMessage();
}

function clean($str)
{
    $str = trim($str);
    $str = strip_tags($str);
    $str = stripslashes($str);
    $str = addslashes(sprintf("%s", $str));
    $str = rawurldecode($str);
    $str = quotemeta($str);
    $str = filter_var($str, FILTER_SANITIZE_STRING);
    $str = htmlentities($str, ENT_QUOTES);
    $str = htmlspecialchars($str);
    return $str;
}

或者直接下載下面文件包覆蓋