WooYun.org

Searchcontrol 中。
      if(!empty($_POST)){
                 if(URL_TYPE==1){
                echo '<meta http-equiv="refresh" content="0;url='.(($_POST['project'])?'?controller=search&project='.$_POST['project'].'&tags='.$_POST['tags']:'/tags/'.$_POST['tags'].'.html').'">';  
                 }else{
                      echo '<meta http-equiv="refresh" content="0;url=?controller=search'.(($_POST['project'])?'&project='.$_POST['project'].'&tags='.$_POST['tags']:'&tags='.$_POST['tags']).'.html">';
                 }
           }else{
 
直接输出了 $_POST[‘tags’] 可以反射xss了。

在downcontrol 中 
$_GET['file']=base64_decode($_GET['file']);
           if(file_exists(ROOT_PATH.$_GET['file'])){            
                 header("Content-Type: application/force-download");
                 header("Content-Disposition: attachment; filename=".basename($_GET['file']));
                 readfile(ROOT_PATH.$_GET['file']);
           }else{
                 echo '<script type="text/javascript">alert("您要下载的文件不存在！");history.back();</script>';
           }
      }
}