old-61 -- SQLi (Value As Column)
<?php
include "../../config.php";
if ($_GET["view_source"]) { view_source(); }
$db = dbconnect();
if (!$_GET["id"]) { $_GET["id"] = "guest"; }
echo "<html><head><title>Challenge 61</title></head><body>";
echo "<a href=./?view_source=1>view-source</a><hr>";
$_GET["id"] = addslashes($_GET["id"]);
if (preg_match("/\(|\)|select|from|,|by|\./i", $_GET["id"])) { exit("Access Denied"); }
if (strlen($_GET["id"]) > 15) { exit("Access Denied"); }
$result = mysqli_fetch_array(
mysqli_query(
$db, "select {$_GET["id"]} from chall61 order by id desc limit 1"
)
);
echo "<b>{$result["id"]}</b><br>";
if ($result["id"] == "admin") { solve(61); }
echo "</body></html>";
?>
Last updated