WooYun.org

simper控制器下的 find_password_mobile方法
//手机短信找回密码
function find_password_mobile()
{
$username = IReq::get('username');
if($username === null || !Util::is_username($username) )
{
IError::show(403,"请输入正确的用户名");
}
$mobile = IReq::get("mobile");
if($mobile === null || !IValidate::mobi($mobile))
{
IError::show(403,"请输入正确的电话号码");
}
$mobile_code = IReq::get('mobile_code');
if($mobile_code === null)
{
IError::show(403,"请输入短信校验码");
}
$userDB = new IModel('user as u , member as m');
$userRow = $userDB->getObj('u.username = "'.$username.'" and m.mobile = "'.$mobile.'" and u.id = m.user_id');
if($userRow)
{
$findPasswordDB = new IModel('find_password');
$dataRow = $findPasswordDB->getObj('user_id = '.$userRow['user_id'].' and hash = "'.$mobile_code.'"');
if($dataRow)
{
//短信验证码已经过期
if(time() - $dataRow['addtime'] > 3600)
{
$findPasswordDB->del("user_id = ".$userRow['user_id']);
IError::show(403,"您的短信校验码已经过期了，请重新找回密码");
}
else
{
$this->redirect('/simple/restore_password/hash/'.$mobile_code);

}
}
else
{
IError::show(403,"您输入的短信校验码错误");
}
}
else
{
IError::show(403,"用户名与手机号码不匹配");
}
}
gpc开了等于没开。 他会把反斜杠去掉 然后用自己的方法去过滤注入
利用条件 能注册普通会员即可 废话。
mobile_code 这个方法没过滤