WooYun.org

app/lib/action/publicaction.class.php
		  class PublicAction extends Action
		  {
			  	public function wirte_log_pay($log){
			  	
			  		$fp = fopen($_SERVER['DOCUMENT_ROOT']."/app/Lib/Log/".$log['file']."_".date('Ymd',$_SERVER['REQUEST_TIME']) .'.log', "a");
					
			  		$s=implode($log['split'],$log['data']);//写出文件 可以发现文件名中的一段可控 我们就能通过截断和解析漏洞来利用
			  		fwrite($fp,$s."\r\n");
			  		fclose($fp);
			  	}
				
				
app/lib/action/Payaction.class.php
public function callback() {
		
		$get = $_REQUEST;
		
		$payway = $get ['paytag'];//
		switch ($get ['paytag']) {
			....省略若干不重要
		}
	
		$public = A ( 'Public' );
		$model = M ( 'pay_ok' );
		// 判断是否存在
		$payorder = $model->where ( "orderid='{$get['orderid']}'" )->find ();
		
		if (! $payorder) {
			$public->wirte_log_pay ( array (
					'data' => $get,//data 也就是request的值
					'file' => 'pay_error_' . $payway,//文件名 payway是通过request来的
					'split' => ' ' 
			) );
			$this->error ( '充值失败!订单号不存在!!!' );
		}