BUUCTF-Web Comment

dirsearch扫出/.git/目录

遂用航神写的Githacker脚本 https://github.com/wangyihang/githacker

出来的源码并不完整，使用git log --reflog查看下记录

选择第一条修改的记录的commit执行git reset --hard bfbdf218902476c5c6164beedd8d2fcf593ea23b

这是恢复后的源码

 1 <?php
 2 include "mysql.php";
 3 session_start();
 4 if($_SESSION['login'] != 'yes'){
 5     header("Location: ./login.php");
 6     die();
 7 }
 8 if(isset($_GET['do'])){
 9 switch ($_GET['do'])
10 {
11 case 'write':
12     $category = addslashes($_POST['category']);
13     $title = addslashes($_POST['title']);
14     $content = addslashes($_POST['content']);
15     $sql = "insert into board
16             set category = '$category',
17                 title = '$title',
18                 content = '$content'";
19     $result = mysql_query($sql);
20     header("Location: ./index.php");
21     break;
22 case 'comment':
23     $bo_id = addslashes($_POST['bo_id']);
24     $sql = "select category from board where id='$bo_id'";
25     $result = mysql_query($sql);
26     $num = mysql_num_rows($result);
27     if($num>0){
28     $category = mysql_fetch_array($result)['category'];
29     $content = addslashes($_POST['content']);
30     $sql = "insert into comment
31             set category = '$category',
32                 content = '$content',
33                 bo_id = '$bo_id'";
34     $result = mysql_query($sql);
35     }
36     header("Location: ./comment.php?id=$bo_id");
37     break;
38 default:
39     header("Location: ./index.php");
40 }
41 }
42 else{
43     header("Location: ./index.php");
44 }
45 ?>