WooYun.org

漏洞文件： protected/modules/group/controllers/indexController.php //341行
public function actionCategory($categoryId=0){
$category = Category::model()->findByPk($categoryId);
if($categoryId!=0):
$dataProvider=new CActiveDataProvider('Group',array(
'pagination'=>array('pageSize'=>24),
'criteria'=>array(
'with'=>array('user'),
'condition'=>'t.status="ok" and categoryId='.$categoryId,
'order'=>'t.memberNum desc,t.addTime desc'
)
));
else:
$dataProvider=new CActiveDataProvider('Group',array(
'pagination'=>array('pageSize'=>24),
'criteria'=>array(
'with'=>array('user'),
'condition'=>'t.status="ok"',
'order'=>'t.memberNum desc,t.addTime desc'
)
));
endif;
$firstCategories = Category::model()->findAllByAttributes(array('type'=>'group','parentId'=>0));
$this->render('category',array(
'dataProvider'=>$dataProvider,
'myGroupDataProvider'=>$this->getMyGroupDataProvider(),
'category'=>$category,
'firstCategories'=>$firstCategories,
'categoryId'=>$categoryId,
));
}
actionCategory函数
public function actionCategory($categoryId=0)
这里虽然设置了默认值，但是事实上我们知道有值的时候还是能传进去的
'condition'=>'t.status="ok" and categoryId='.$categoryId,这里作为sql语句的一部分是直接传进去了。
这个是yii的框架，我就忽略其他代码了！