WooYun.org

var u_account = context.Request.Form["username"];
        var find_type = context.Request.Form["findtype"];
        var find_question = context.Request.Form["find_qus"];
        var find_answer = context.Request.Form["find_answer"];
        DataManage.UserEng ung = new DataManage.UserEng();
        var _user_ = ung.GetItem(u_account);

u_account参数未过滤（就是username），直接带入到了ung.GetItem中：
        public Apw_User GetItem(string account)
        {
            return this.dataserver.GetAll<Apw_User>("select * from Apw_User where u_Account='" + account.Trim() + "'").FirstOrDefault<Apw_User>();
        }