Searching at the front desk `inc/zzz_template.php`
![](https://images.seebug.org/1564131176645-w331s)
You can see that the parameter keys can be retrieved from the cookie, but the cookie is not filtered. The `searchcol` parameter is taken from the post form, but it does not require quotation escapes. It is a numeric injection and both parameters exist. Injection point.
Payload determined by delay:
![](https://images.seebug.org/1564131200533-w331s)
Use sqlmao to verify
![](https://images.seebug.org/1564131218540-w331s)
暂无评论