BUUCTF-Web Comment

dirsearch扫出/.git/目录

遂用航神写的Githacker脚本 https://github.com/wangyihang/githacker

出来的源码并不完整，使用git log --reflog查看下记录

选择第一条修改的记录的commit执行git reset --hard bfbdf218902476c5c6164beedd8d2fcf593ea23b

这是恢复后的源码

 <?php

 include "mysql.php";

 session_start();

 if($_SESSION['login'] != 'yes'){

     header("Location: ./login.php");

     die();

 }

 if(isset($_GET['do'])){

 switch ($_GET['do'])

 {

 case 'write':

     $category = addslashes($_POST['category']);

     $title = addslashes($_POST['title']);

     $content = addslashes($_POST['content']);

     $sql = "insert into board

             set category = '$category',

                 title = '$title',

                 content = '$content'";

     $result = mysql_query($sql);

     header("Location: ./index.php");

     break;

 case 'comment':

     $bo_id = addslashes($_POST['bo_id']);

     $sql = "select category from board where id='$bo_id'";

     $result = mysql_query($sql);

     $num = mysql_num_rows($result);

     if($num>0){

     $category = mysql_fetch_array($result)['category'];

     $content = addslashes($_POST['content']);

     $sql = "insert into comment

             set category = '$category',

                 content = '$content',

                 bo_id = '$bo_id'";

     $result = mysql_query($sql);

     }

     header("Location: ./comment.php?id=$bo_id");

     break;

 default:

     header("Location: ./index.php");

 }

 }

 else{

     header("Location: ./index.php");

 }

 ?>