WooYun.org

/api/tenpay/return_url.php
require_once(dirname(dirname(dirname(__FILE__)))."/data/db.config.php");
require_once(dirname(dirname(dirname(__FILE__)))."/include/mysql.class.php");
$db = new mysql($db_config['dbhost'], $db_config['dbuser'], $db_config['dbpass'], $db_config['dbname'], ALL_PS, $db_config['charset']);
/* 密钥 */
$key =$tenpay[sy_tenpaycode];
//密钥没有定义
=========
tenpay_data.php
<?php
/*
 * Created on 2012
 * Link for [email protected]
 * This PHPYun.Rencai System Powered by PHPYun.com
 */
$tenpaydata=array("sy_weburl"=>"http://www.job.com","sy_tenpayid"=>"","sy_tenpaycode"=>"")//没有定义KEY 所以是空~~
;
?>
=========
/* 创建支付应答对象 */
$resHandler = new PayResponseHandler();
$resHandler->setKey($key);//还是key没有初始化~~
//判断签名
if($resHandler->isTenpaySign()) {//验证过程
/**********************************3
	function isTenpaySign() {
		$cmdno = $this->getParameter("cmdno");
		$pay_result = $this->getParameter("pay_result");
		$date = $this->getParameter("date");
		$transaction_id = $this->getParameter("transaction_id");
		$sp_billno = $this->getParameter("sp_billno");
		$total_fee = $this->getParameter("total_fee");		
		$fee_type = $this->getParameter("fee_type");
		$attach = $this->getParameter("attach");
		$key = $this->getKey();
		
		$signPars = "";
		//组织签名串
$signPars = "cmdno=" . $cmdno . "&" .
				"pay_result=" . $pay_result . "&" .
				"date=" . $date . "&" .
				"transaction_id=" . $transaction_id . "&" .
				"sp_billno=" . $sp_billno . "&" .
				"total_fee=" . $total_fee . "&" .
				"fee_type=" . $fee_type . "&" .
				"attach=" . $attach . "&" .
				"key=" . $key;
				
		$sign = strtolower(md5($signPars));//key是空 其他都是可控 我们之间就可以生成key 所以验证形同虚设 没有设置key的时候
***********************************/
	//交易单号
	$transaction_id = $resHandler->getParameter("transaction_id");
	//本站单号
	$sp_billno = $resHandler->getParameter("sp_billno");
	//金额,以分为单位
	$total_fee = $resHandler->getParameter("total_fee");
	//支付结果
	$pay_result = $resHandler->getParameter("pay_result");
	//类型
	$attach = $resHandler->getParameter("attach");
	if( "0" == $pay_result ) {
		//------------------------------
		//处理业务开始
		//------------------------------
		//注意交易单不要重复处理
		//注意判断返回金额
//处理本站信息开始
echo "select * from `".$db_config["def"]."company_order` where `order_id`='$sp_billno'";
	$sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='$sp_billno'");
	
    $row=mysql_fetch_array($sql);