WooYun.org

member.php
if(!empty($_COOKIE['username']) &&//从COOKIE里面解密username然后赋值
   !empty($_COOKIE['lastlogintime']) &&
   !empty($_COOKIE['lastloginip']))
{
	$c_uname     = AuthCode($_COOKIE['username']);
	$c_logintime = AuthCode($_COOKIE['lastlogintime']);
	$c_loginip   = AuthCode($_COOKIE['lastloginip']);
}
else
{
	$c_uname     = '';
	$c_logintime = '';
	$c_loginip   = '';
}
//验证是否登录和用户合法
if($a=='saveedit'    or $a=='getarea'    or $a=='savefavorite' or
   $a=='delfavorite' or $a=='delcomment' or $a=='delmsg' or
   $a=='delorder'    or $a=='avatar'     or $a=='getgoods' or
   $a=='applyreturn' or $a=='perfect'    or $a=='binding' or
   $a=='removeoqq'   or $a=='removeoweibo')
{
	if(!empty($c_uname))
	{
		//guest为一键登陆未绑定账号时的临时用户
		if($c_uname != 'guest')
		{
			$r = $dosql->GetOne("SELECT `id`,`expval` FROM `#@__member` WHERE `username`='$c_uname'");//通过上面的可以看出来源
            
shoppingcart.php
if($a == 'addshopingcart')
{
	 //构成选中属性
	if(isset($typeid))
	{
		//参数过滤
		$typeid = intval($typeid);
		//获取商品属性
		$dosql->Execute("SELECT * FROM `#@__goodsattr` WHERE `goodsid`=$typeid");
		if($dosql->GetTotalRow() > 0)
		{echo 55555;
			//构成属性字符串
			$goodsattr = array();
			while($row = $dosql->GetArray())
			{
				//选中的属性构成字符串
				if(isset($_POST['attrid_'.$row['id']]))
				{
					$goodsattr[$row['id']] = $_POST['attrid_'.$row['id']];//这里的参数可以控制
				}
			}
	var_dump($goodsattr);
		}
		else
		{
			$goodsattr[$row['id']] = '';
		}
	}
	//初始化购物车字符串
	if(!empty($_COOKIE['shoppingcart']))
		$shoppingcart = unserialize(AuthCode($_COOKIE['shoppingcart']));
	else
		$shoppingcart = array();
	//选中信息存入数组
	if(isset($goodsid) &&
	   isset($buynum) &&
	   isset($goodsattr))
	{
		//过滤参数
		$goodsid = intval($goodsid);
		$buynum  = intval($buynum);
		
		$shoppingcart[] = array($goodsid, $buynum, $goodsattr);
	}
var_dump($shoppingcart);
	//存入COOKIE
	setcookie('shoppingcart', AuthCode(serialize($shoppingcart),'ENCODE'));//吧购物车的内容加密之后存入cookie 这样我们就能先利用$_POST['attrid_'.$row['id']]来写入我们的注入shellcode，然后将将得到的shoppingcart的COOKIE改成username就可以达到利用了
	echo TRUE;
	exit();