WooYun.org

Protected/apps/members/meberApi.php  
public function powerCheck(){//参数一：返回1没有权限，返回2为登陆有权限，返回数组登陆有权限
		 $cookie_auth=get_cookie('auth');//验证的时候从cookie中获取信息，拿我们看get_cookie函数
     if(empty($cookie_auth)) $group_id=1;//未登录组
     else{
        $memberinfo=explode('\t',$cookie_auth); 
        $auth['id']=$memberinfo[0];
        $auth['groupid']=$memberinfo[1];
        $auth['account']=$memberinfo[2];
        $auth['nickname']=empty($memberinfo[3])?'未知':$memberinfo[3];
        $auth['lastip']=$memberinfo[4];
        $auth['headpic']=$memberinfo[5];
        $group_id=$auth['groupid'];
     }
      $notallow=model('memberGroup')->find("id={$group_id}");//这里是重点，将$group_id直接带进去查询，而这个$group_id是从cookie里取得的，我们直接伪造cookie，进行注入。
      if(empty($notallow['notallow'])) return $group_id==1?array(2,$group_id):array($auth,$group_id);
      else{
        $flog=2;
        $rules=explode('|',$notallow['notallow']);
        foreach ($rules as $rule) {
          $power=explode(',',$rule);
          //R匹配
          $reds=explode('/',$power[0]);
          if(!empty($reds[0]) && $reds[0]==APP_NAME) $flog=1;
          if(!empty($reds[1]) && 1==$flog && $reds[1]!=CONTROLLER_NAME) $flog=2;
          if(!empty($reds[2]) && 1==$flog && $reds[2]!=ACTION_NAME) $flog=2;
          //参数匹配判断
          if(!empty($power[1]) && 1==$flog){
            $items=explode('/',$power[1]);
            if(!empty($items)){
              foreach ($items as $value) {
                 $gets=explode('=',$value);
                 if(!empty($gets[1]) && 1==$flog && $_GET[$gets[0]]!=$gets[1]) $flog=2;
              }
            }
          }
          if(1==$flog) return array($flog,$group_id);
        }
        return $group_id==1?array(2,$group_id):array($auth,$group_id);
      }
  }