usercheck php,zzcms user/logincheck.php SQL注入漏洞

inc/function.php 72行

```php

function getip(){

if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))

$ip = getenv("HTTP_CLIENT_IP");

else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))

$ip = getenv("HTTP_X_FORWARDED_FOR");

else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))

$ip = getenv("REMOTE_ADDR");

else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))

$ip = $_SERVER['REMOTE_ADDR'];

else

$ip = "unknown";

return($ip);

}

```

继续看 `user/logincheck.php` 第19行

```php

$ip=getip();

define('trytimes',5);//可尝试登录次数

define('jgsj',10*60);//间隔时间，秒

$sql="select * from zzcms_login_times where ip='$ip' and count>=".trytimes." and unix_timestamp()-unix_timestamp(sendtime)

$rs = query($sql);

$row= num_rows($rs);

if ($row){

```

ip没有任何过滤 直接进入sql语句查询 导致 sql注入漏洞