WooYun.org

$act = !empty($_REQUEST['act']) ? trim($_REQUEST['act']) : 'enter';
$smarty->assign('header_nav',"getpass");
if ($act=='enter')
{
        $smarty->assign('title','找回密码 - '.$_CFG['site_name']);
        $token=substr(md5(mt_rand(100000, 999999)), 8,16); //生成token
        $_SESSION['getpass_token']=$token; //保存到session中
        $smarty->assign('token',$token); //通过smarty 显示到前台 我们可以看到
        $smarty->display('user/get-pass.htm');
}

elseif($act == "get_pass_save")
{
        global $QS_pwdhash;
        if(empty($_POST['token']) || $_POST['token']!=$_SESSION['getpass_token']) //这个值上面可以获得得到 这就绕过了
        {
                $link[0]['text'] = "重新找回密码";
                $link[0]['href'] = "?act=enter";
                showmsg("找回密码失败，非正常链接",0,$link);
        }
        $uid=intval($_POST['uid']);//uid可控 遍历uid可重置任意账号密码
        $password=$_POST['password']?trim($_POST['password']):showmsg("请输入密码！",1); 
        $userinfo=get_user_inid($uid);
        if(empty($userinfo))
        {
                $link[0]['text'] = "重新找回密码";
                $link[0]['href'] = "?act=enter";
                showmsg("修改密码失败",0,$link);
        }
        $password_hash=md5(md5($password).$userinfo['pwd_hash'].$QS_pwdhash);
        $setsqlarr['password']=$password_hash;
        $rst=$db->updatetable(table('members'),$setsqlarr,array("uid"=>$userinfo['uid']));//更改密码
        if($rst)
        {
                header("Location: ?act=get_pass_sucess"); 
        }       
        else
        {
                showmsg("设置新密码失败！",1);
        }
}