WooYun.org

/srun3/srun/web/douser.php
		case "checkip":
				$user->user_ip=$_POST["user_ip"];//注入变量
				$user->user_login_name=$_POST["user_login_name"];
				if($user->checkUserIp())//直接注入
				{
					echo "ok";
				}
				exit;
				break;
			function checkUserIp()
		{
			$sql = "SELECT COUNT(*) FROM user WHERE (user_ip='".$this->user_ip."' OR user_ip2='".$this->user_ip."' OR //可以看到直入接带入查询的
user_ip3='".$this->user_ip."' OR user_ip4='".$this->user_ip."') AND user_login_name!='".$this->user_login_name."'";
			if($this->getNumber($sql)>0)
					return false;
			return true;
		}