WooYun.org

public function member(){
		global $_COOKIE,$Lang,$Warning;
		$Origin = $Lang == 1 ? './?flogin' : "./?flogin/l{$Lang}";
		if(empty($_COOKIE['User']['Name']) || $_COOKIE['isLogin'] != 'songcms'){    
			MsgBox(1,$Warning[19],$Origin); 
		} else {
			$SQL = "SELECT * FROM `{$this->dbprefix}user` WHERE `UserName` = '{$_COOKIE['User']['Name']}'"; //此处$_COOKIE['User']['Name']未过滤直接带入sql语句，满足else 条件即可造成注入
			$result = $this->SelectSQL($SQL,1);
			if(count($result) == 1){
				return array_shift($result);	
			} elseif(UC_ENABLED == 1) { 
				include_once($this->UC_dir.'uc_client/client.php');
				list($uid,$username,$email) = uc_get_user($_COOKIE['User']['Name'],0);
				if($uid > 0){
					$SQL = "INSERT INTO `{$this->dbprefix}user` (`UserName`,`UserEmail`,`UserLogin`,`UserLoginIP`,`UserLoginTime`,`UserRegIP`,`UserRegTime`,`UserAudit`)";
					$SQL .= "VALUES ('{$username}','{$email}','0','" . $_SERVER['REMOTE_ADDR'] . "',NOW(),'" . $_SERVER['REMOTE_ADDR'] . "',NOW(),'{$this->Audit}');";
					$oid = $this->ExecuteSQL($SQL,1);
					$SQL = "SELECT * FROM `{$this->dbprefix}user` WHERE `ID` = '{$oid}'";
					$result = $this->SelectSQL($SQL,1);	
					return array_shift($result);				
					if(count($result) == 1){
						return array_shift($result);
					} else {
						MsgBox(1,'Error:55140',$Origin);	
					}
				}
			} else {
				MsgBox(1,$Warning[19],$Origin); 
			}
		}
	}