[ webhacking.kr ] 59번 old

sangjun

2022. 1. 23. 17:51

문제 소스

<?php
  include "../../config.php";
  if($_GET['view_source']) view_source();
  $db = dbconnect();
  if($_POST['lid'] && isset($_POST['lphone'])){
    $_POST['lid'] = addslashes($_POST['lid']);
    $_POST['lphone'] = addslashes($_POST['lphone']);
    $result = mysqli_fetch_array(mysqli_query($db,"select id,lv from chall59 where id='{$_POST['lid']}' and phone='{$_POST['lphone']}'"));
    if($result['id']){
      echo "id : {$result['id']}<br>lv : {$result['lv']}<br><br>";
      if($result['lv'] == "admin"){
      mysqli_query($db,"delete from chall59");
      solve(59);
    }
    echo "<br><a href=./?view_source=1>view-source</a>";
    exit();
    }
  }
  if($_POST['id'] && isset($_POST['phone'])){
    $_POST['id'] = addslashes($_POST['id']);
    $_POST['phone'] = addslashes($_POST['phone']);
    if(strlen($_POST['phone'])>=20) exit("Access Denied");
    if(preg_match("/admin/i",$_POST['id'])) exit("Access Denied");
    if(preg_match("/admin|0x|#|hex|char|ascii|ord|select/i",$_POST['phone'])) exit("Access Denied");
    mysqli_query($db,"insert into chall59 values('{$_POST['id']}',{$_POST['phone']},'guest')");
  }
?>
<html><head><title>Challenge 59</title></head><body>
<form method=post>
<table border=1>
<tr><td></td><td>ID</td><td>PHONE</td><td></td></tr>
<tr><td>JOIN</td><td><input name=id></td><td><input name=phone></td><td><input type=submit></td></tr>
<tr><td>LOGIN</td><td><input name=lid></td><td><input name=lphone></td><td><input type=submit></td></tr>
</form>
<br>
<a href=./?view_source=1>view-source</a>
</body></html>

문제 풀이

- mysql 내장함수 이용, -- 주석 뒤에는 무조건 공백 들어가야 주석처리 된다.

https://springofdev.tistory.com/entry/MySQL-%EC%A3%BC%EC%84%9D

저작자표시

'War Games > webhacking.kr' 카테고리의 다른 글

[ webhacking.kr ] 56번 old (0)	2022.01.24
[ webhacking.kr ] 57번 old (0)	2022.01.24
[ webhacking.kr ] 58번 old (0)	2022.01.24
[ webhacking.kr ] 59번 old (0)	2022.01.23
[ webhacking.kr ] 60번 old (0)	2022.01.23
[ webhacking.kr ] 61번 old (0)	2022.01.23