126cms后台登陆注入漏洞

以下是引用片段：

……若干……
if( !$postdb["userid"] || !$postdb["pwd"] )
{
 echo "

";
 exit;
}

$postdb["pwd"]=md5($postdb["pwd"]);

        $query="SELECT * FROM `w6_admin` WHERE `userid` ='".$postdb["userid"]."'"; //你懂的

          $result=mysql_query($query) or die("Could not connect: " . mysql_error());
       
        $num = mysql_num_rows($result);
       
        if( $num == 0 )
        {
         echo "

";
         exit;
        }
       
        $_pwd        =  stripslashes(mysql_result($result,"0","pwd"));
        $gptype        =  stripslashes(mysql_result($result,"0","gptype"));
        $adminid        =  stripslashes(mysql_result($result,"0","id"));
        ……若干……