WooYun.org

<%
   response.setHeader("Cache-Control","no-store");
   response.setHeader("Pragma","no-cache");
   response.setDateHeader ("Expires", 0);
String voitureid = request.getParameter("voitureid");
String startdate = request.getParameter("startdate");
String enddate = request.getParameter("enddate");
//System.out.println("startdate="+startdate);
//System.out.println("enddate="+enddate);
long startD = Long.parseLong(startdate);
long endD = Long.parseLong(enddate);
   String returnStr = "1";
   String[][] res11 = null;
   DbOpt dbopt = null;
	  try {
			dbopt = new DbOpt();
	    String  sql = "select t.startdate,t.starttime,t.enddate,t.endtime from oa_voitureapply t where t.status=2 and voitureid="+voitureid;//voitureid未过滤导致注入
	                //System.out.println("sql="+sql);
			res11 = dbopt.executeQueryToStrArr2(sql,4);
			if(res11 != null){
				for(int i=0;i<res11.length;i++){
				   String startdate0 = res11[i][0].substring(0,10).replaceAll("-","");
				   String starttime0 = res11[i][1].replaceAll(":","");
				   String enddate0   = res11[i][2].substring(0,10).replaceAll("-","");
				   String endtime0   = res11[i][3].replaceAll(":","");
				   long startD0    = Long.parseLong(startdate0+starttime0);
				   long endD0      = Long.parseLong(enddate0+endtime0);
				   //System.out.println("startD0="+startD0);
//System.out.println("endD0="+endD0);
          if( ((startD >= startD0) && (startD <= endD0)) ||
				      ((endD >= startD0) && (endD <= endD0)) ||
				      ((startD <= startD0) && (endD >= endD0)) ){
				       returnStr = "0";
				       break;
				    }
				}
			}
			dbopt.close();
	  } catch (Exception e) {
		    //System.out.println("error in Voituregetsource.jsp::::::"+e);
	  } finally {
		    try {
		        dbopt.close();
		    } catch (SQLException ex) {
		    }
	  }
   out.print(returnStr);
%>