Notedog 2.5.0 chicken ribs Injection Vulnerability

I accidentally discovered that I only tested the "Dog microblog system 2.5.0 UTF8 Build 20110130"
 
Because the system will convert "_" to "\ _", I cannot do anything like "load_file" or "table prefix". I have no idea how to bypass it for the moment. It is a technical challenge.
 
Test method:
 
A http://www.bkjia.com/index. php? Code = usertag & mod = search & usertag = 1 "/**/and/**/1 = 2/**/union/**/select/**/1, host, 4/**/from/**/mysql. user % 23
 
EXP does not have a serious impact and is only for research.

From crazy blogs | Madman@SysCiC.TeAm