WooYun.org

public function all() {
        $_Obj = M($this->objName);
        $categoryObj = M("category");
        $_Obj->pageSize = 20;
        $where = "1=1";
        $key = $_POST['key'];//注入
        $cid = $_GET['cid'];
        if ($key != "") {
            $where .= " and id = '" . $key . "' or title like '%$key%'";//注入 下面多处都是注入
        }
        if (!empty($cid) && $cid != "") {
            $where .= " and classid = " . $cid;
        }
        if ($_GET["type"] == "user") {
            $where .= " and uid = " . $_COOKIE['userId'];