Ocean CMS vulnerability - search php

stay i Made in spring and Autumn CTF The topic , There is one “ Baidu Cup ”CTF match September The title of is Test, yes web type .

Open and find the ocean CMS：

See is cms, Immediately searched the ocean CMS Loophole , Found a lot on the Internet , Mainly search.php Vulnerability .

Start solving the problem ：

1. Click any one in the query bar ：

See such a url, You can construct a payload：

I don't know why ······

2. Kitchen knife connection

Then you can connect it directly with a kitchen knife

No, flag, It should be in the database ,

find search.php, Open it and see. ：

The discovery contains common.php This file , Keep looking ：

 

  Here is the path of the database configuration file , To find out ：

  Configure kitchen knife , Connect to database ：

 

  Change the query statement ：

Successfully get flag.