WooYun.org

$pararr = explodestpar( $_REQUEST['par'] );
$userpriv = $pararr['userpriv'];
...
if ( $pararr['view_type'] == 0 )
{
				unset( $deptnameutf8 );
				unset( $action );
				unset( $src );
				unset( $target );
				unset( $icon );
				$usql = "\r\n\t\t\tSELECT * FROM USER,USER_PRIV \r\n\t\t\t\tWHERE USER.USER_PRIV=".$userpriv." \r\n\t\t\t\tAND USER.USER_PRIV=USER_PRIV.USER_PRIV \r\n\t\t\t\tORDER BY PRIV_NO,USER_NAME\r\n\t\t\t";
				$urs = exequery( $connection, $usql );

function explodeStPar( $enpar )
{
				$depar = base64_decode( $enpar );
				$arrpar = explode( "|", $depar );
				if ( !is_array( $arrpar ) )
				{
								return false;
				}
				$i = 0;
				for ( ;	$i < sizeof( $arrpar );	++$i	)
				{
								$strpar = $arrpar[$i];
								$tmparr = explode( ":", $strpar );
								$j = 0;
								for ( ;	$j < sizeof( $tmparr );	++$j	)
								{
												if ( $j == 0 )
												{
																preg_match( "/\\[([a-z0-9-_].+)\\]/i", $tmparr[$j], $exp );
																$par = $exp[1];
												}
												else
												{
																preg_match( "/\\[(.*)\\]/i", $tmparr[$j], $exp );
																$val = $exp[1];
												}
								}
								if ( trim( $par ) != "" )
								{
												$rearr[$par] = $val;
								}
				}
				return $rearr;
}