WooYun.org

case 'income':
		$same_pwd = @$db->result_first("select count(*) from {$tpf}users where password=income_pwd and userid='$pd_uid'");
		$rs = $db->fetch_one_array("select * from {$tpf}users where userid='$pd_uid'");
		if($rs){
			$wealth_lost = $rs['wealth_lost'] ? (int)$rs['wealth_lost'] : ($settings['wealth_lost'] ? (int)$settings['wealth_lost'] : 0);
			$wealth = $rs['wealth'];
			$income_account = $rs['income_account']; //直接提取
			$income_name = $rs['income_name']; //直接提取
			$income_type = $rs['income_type'];
			$income_type_txt = $arr[$income_type];
		......中间省略......
			if(!$error){
				$ins = array(
				'order_number' => get_order_number(),
				'income_account' => $income_account,
				'income_name' => $income_name,
				'income_type' => $income_type,
				'o_status' => 'pendding',
				'userid' => $pd_uid,
				'money' => $money,
				'ip' => $onlineip,
				'in_time' => $timestamp,
				);echo "insert into {$tpf}income_orders set ".$db->sql_array($ins)."";
				$db->query_unbuffered("insert into {$tpf}income_orders set ".$db->sql_array($ins).""); //注入点
				$db->query_unbuffered("update {$tpf}users set wealth=$now_wealth where userid='$pd_uid'");
				$sysmsg[] = __('add_income_order_success');
				redirect('back',$sysmsg);
			}else{
				redirect('back',$sysmsg);
			}
		}else{
			$curr_credit_rate = $myinfo[credit_rate] ? exp_credit_rate($myinfo[credit_rate]) : (($settings[how_downs_credit] && $settings[how_money_credit]) ? $settings[how_downs_credit].'==￥'.$settings[how_money_credit] : '');
			$freeze_money = @$db->result_first("select sum(money) from {$tpf}income_orders where userid='$pd_uid' and o_status='pendding'");
			$freeze_money = $freeze_money ? '<span class="txtgray">（'.__('incoming').':￥'.$freeze_money.'）</span>' : '';
			$my_downlines = @$db->result_first("select count(*) from {$tpf}buddys where userid='$pd_uid'");
			require_once template_echo('profile',$user_tpl_dir);
		}
		break;