DedeCms V5.6漏洞 变量未初始化 导致鸡助漏洞

if($mid == 0) //必须绕过。 { showmsg(\’参数不正确，高级自定义搜索必须指定模型id\’, \’javascript\’); exit(); } $query = \”select maintable, mainfields, addontable, addonfields, template from dede_advancedsearch where mid=\’$mid\’\”; $searchinfo = $dsql->GetOne($query); if(!is_array($searchinfo)) //囧啊，绕过有难度。 { showmsg(\’自定义搜索模型不存在\’,\’-1\’); exit(); } $template = $searchinfo[\’template\’] != \’\’ ? $searchinfo[\’template\’] : \’advancedsearch.htm\’; if(empty($sql)) //人品问题，成功绕过！{ ………….. }else{ $sql = urldecode($sql); $query = $sql; } $sql = urlencode($sql); $dlist = new DataListCP(); $dlist->pageSize = 20; $dlist->SetParameter(\”sql\”, $sql); $dlist->SetParameter(\”mid\”, $mid); …………… $dlist->SetTemplate($templatefile); $dlist->SetSource($query); ………….<*参考 *>