WooYun.org

cupcms/modules/member/archivers.php
if($G['do'] == 'update')
{
     $data['arc'] = P('archives');$data['model'] = P('model');//设置Module
	 $id = (int)p('id');
	 echo INC.'libs/model/'.$_GET['model'].'.func.php';
	 if(file_exists(INC.'libs/model/'.$_GET['model'].'.func.php'))
	 {
	      f('model/'.$_GET['model']);
	 }
	 if(function_exists($_GET['model'].'post'))
	 {
	      $data['model'] = call_user_func($_GET['model'].'post',$data['model']);
	 }	
	 $arc->update($data['arc'],$data['model'],$id);	 //update插入 第二个参数是列名~~
	 if(!empty($arc->error))
	 {
	   showtips($arc->error,url('detail',dreferer()));
	 }