WooYun.org

/app/lib/action/membersaction.class.php
public function card_check(){
      	    $card_log =M('card_log');
			$gid = $_GET['gid'];//获取参数
			$sid = $_GET['sid'];
			list ($uid,$username) = explode ("\t",uc_authcode($_COOKIE['auth'],'DECODE'));
			if($data = uc_get_user($username)) {
				list($uid, $username, $email) = $data;
			}
		
			$st = $card_log->where('gid='.$gid.' and sid='.$sid.' and uid='.$uid)->find();//注入点
	
			if($st){
				$arr['msg'] = '你已经申请，新手卡为：'.$st['card_info'];
				$arr['state'] = '-1';
				die(json_encode($arr));
			}else{
				//若该用户未获取新手卡则根据gid sid 去获取一行新手卡
				$card =M('card');
				$card_info = $card->where('gid='.$gid.' and sid='.$sid)->select();
				$now_time=time();