php代码审计之MetInfo5.3盲注

<?php
# MetInfo Enterprise Content Management System 
# Copyright (C) MetInfo Co.,Ltd (http://www.metinfo.cn). All rights reserved. 
require_once ‘../include/common.inc.php‘;
$mdname = ‘img‘;
$showname = ‘showimg‘;
$dbname = $met_img;
$dbname_list = $met_img_list;
$mdmendy = 1;
$imgproduct = ‘img‘;
$class1re = ‘‘;
require_once ‘../include/global/listmod.php‘;
$img_listnow = $modlistnow;
$img_list_new  = $md_list_new;
$img_class_new = $md_class_new;
$img_list_com  = $md_list_com;
$img_class_com = $md_class_com;
$img_class     = $md_class;
$img_list      = $md_list;
require_once ‘../public/php/imghtml.inc.php‘;
include template(‘img‘);
footer();
# This program is an open source system, commercial use, please consciously to purchase commercial license.
# Copyright (C) MetInfo Co., Ltd. (http://www.metinfo.cn). All rights reserved.
echo $dbname
?>

/*读配置数据*/
$query = "SELECT * FROM $met_config WHERE lang=‘$lang‘ or lang=‘metinfo‘";
$result = $db->query($query);
while($list_config= $db->fetch_array($result)){
    if($metinfoadminok)$list_config[‘value‘]=str_replace(‘"‘, ‘"‘, str_replace("‘", ‘'‘,$list_config[‘value‘]));
    $settings_arr[]=$list_config;
    if($list_config[‘columnid‘]){
        $settings[$list_config[‘name‘].‘_‘.$list_config[‘columnid‘]]=$list_config[‘value‘];
    }else{
        $settings[$list_config[‘name‘]]=$list_config[‘value‘];
    }
    if($list_config[‘flashid‘]){
        $list_config[‘value‘]=explode(‘|‘,$list_config[‘value‘]);
        $falshval[‘type‘]=$list_config[‘value‘][0];
        $falshval[‘x‘]=$list_config[‘value‘][1];
        $falshval[‘y‘]=$list_config[‘value‘][2];
        $falshval[‘imgtype‘]=$list_config[‘value‘][3];
        $met_flasharray[$list_config[‘flashid‘]]=$falshval;
    }
}
@extract($settings);

$query="select * from $met_column where module=‘$search_module‘ and (classtype=1 or releclass!=0) and lang=‘$lang‘ order by no_order ASC,id ASC";