WooYun.org

订单越权查看漏洞
出现问题的代码位于source/member.php处
function myorder(){
if($this->syArgs('oid')||$this->syArgs('orderid',1)!=''){
if($this->syArgs('oid')){$r=array('id'=>$this->syArgs('oid'));}else{$r=array('orderid'=>$this->syArgs('orderid',1));}
$this->order=syDB('order')->find($r);
if($this->order['state']>0&&$this->order['virtual']==1)$this->virtuals=syDB('product_virtual')->findAll(array('oid'=>$this->order['id'],'state'=>1));
$this->goods=order_goods(unserialize($this->order['goods']),$this->order['logistics']);
$this->info=unserialize($this->order['info']);
$this->sendgoods=unserialize($this->order['sendgoods']);
$total=0;
foreach($this->goods[0] as $v){
$total=calculate($total,$v['total']);
$total=calculate($total,$v['logistics_price']);
}
$this->aggregate=calculate($total, $this->order['favorable'],2);
$this->display("member/myorderinfo.html");
}else{
$c=syClass('c_order');
$total_page=total_page($GLOBALS['G_DY']['db']['prefix'].'order where uid='.$this->my['id']);
$this->lists=$c->syPager($this->syArgs('page',0,1),10,$total_page)->findAll(array('uid'=>$this->my['id']),' addtime desc ');
$c_page=$c->syPager()->getPager();
$this->pages=pagetxt($c_page,$GLOBALS['G_DY']['url']["url_path_base"].'?c=member&a=myorder');
$this->display("member/myorder.html");
}
}

这段代码用于查看用户的订单信息
254,255,256行是关键点
但是用于查询订单信息的条件却过于简单，直接导致通过修改URL参数查看其它用户的订单信息。
验证，我注册两个用户sss 和zzz 使用系统管理员给两人注入一些钱（模拟用户）各买东西形成订单

在zzz用户页面修改oid可以看到

他果然看到了sss购买的商品以及下面的订货信息