WooYun.org

if (!$this->fun->is_token()) { //这里 可以直接绕过的 
			$this->callmessage($this->lng['repeatinput'], $linkURL, $this->lng['gobackbotton']);
		}
 		$lng = (admin_LNG == 'big5') ? $this->CON['is_lancode'] : admin_LNG;
		if ($this->CON['is_enquiry_memclass']) {
			parent::member_purview(0, $this->get_link('enquiry', array(), admin_LNG));
		}
		$cartid = $this->fun->eccode($this->fun->accept('ecisp_enquiry_list', 'C'), 'DECODE', db_pscode);
		$cartid = stripslashes(htmlspecialchars_decode($cartid));
		$uncartid = !empty($cartid) ? unserialize($cartid) : 0;
		
		$userid = intval($this->fun->accept('userid', 'P'));
		$userid = !empty($userid) ? $userid : 0;
		$linkman = trim($this->fun->accept('linkman', 'P', true, true));
		$linkman = $this->fun->substr($linkman, 20);
		$email = $this->fun->accept('email', 'P', true, true);
		$sex = $this->fun->accept('sex', 'P');
		$sex = empty($sex) ? 0 : intval($sex);
		$country = intval($this->fun->accept('cityone', 'P'));
		$country = empty($country) ? 0 : $country;
		$province = intval($this->fun->accept('citytwo', 'P'));
		$province = empty($province) ? 0 : $province;
		$city = intval($this->fun->accept('citythree', 'P'));
		$city = empty($city) ? 0 : $city;
		$district = intval($this->fun->accept('district', 'P'));
		$district = empty($district) ? 0 : $district;
		$address = trim($this->fun->accept('address', 'P', true, true));
		$address = $this->fun->substr($address, 120);
		$zipcode = trim($this->fun->accept('zipcode', 'P', true, true));
		$zipcode = $this->fun->substr($zipcode, 10);
		$tel = trim($this->fun->accept('tel', 'P', true, true));
		$tel = $this->fun->substr($tel, 20);
		$mobile = trim($this->fun->accept('mobile', 'P', true, true));
		$mobile = $this->fun->substr($mobile, 15);
		$fax = trim($this->fun->accept('fax', 'P', true, true));
		$fax = $this->fun->substr($fax, 15);
		$content = trim($this->fun->accept('content', 'P', true, true));
		$content = $this->fun->substr($content, 500);
		$amount = $this->fun->accept('amount', 'P');
		$ptitle = $this->fun->accept('ptitle', 'P');
		$tsn = $this->fun->accept('tsn', 'P');
		$did = $this->fun->accept('did', 'P');
	
		if (empty($did) || empty($amount) || empty($ptitle)) {
			$enquirylink = $this->get_link('enquiry', array(), admin_LNG);
			$this->callmessage($this->lng['enquiry_input_err'], $enquirylink, $this->lng['enquiry_into_listbotton']);
		}
		
		if (!preg_match("/^\w+((-\w+)|(\.\w+))*\@[A-Za-z0-9]+((\.|-)[A-Za-z0-9]+)*\.[A-Za-z0-9]+$/i", $email)) {
			$this->callmessage($this->lng['email_err'], $_SERVER['HTTP_REFERER'], $this->lng['gobackbotton']);
		}
		$enquirysn = date('YmdHis') . rand(100, 9999);
		$db_table = db_prefix . 'enquiry';
		$db_table2 = db_prefix . 'enquiry_info';
		$addtime = time();
		$db_field = 'enquirysn,userid,linkman,sex,country,province,city,district,address,zipcode,tel,fax,mobile,email,content,isclass,addtime,edittime';
		$db_values = "'$enquirysn',$userid,'$linkman',$sex,$country,$province,$city,$district,'$address','$zipcode','$tel','$fax','$mobile','$email','$content',0,$addtime,0";
		$this->db->query('INSERT INTO ' . $db_table . ' (' . $db_field . ') VALUES (' . $db_values . ')');
		$insert_id = $this->db->insert_id();
		$db_values = '';
		$arraycount = count($did) - 1;
			
		foreach ($did as $key => $value) {
			$value = intval($value);
			$amount[$key] = intval($amount[$key]);
			if ($key == $arraycount) {
				$db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],'')";
			} else {
				$db_values.= "($insert_id,$value,'$tsn[$key]','$ptitle[$key]',$amount[$key],''),";
			}
                 // 关键是这里 和 DZ7.2那个注入漏洞一样 如果 tsn并不是数组的话 他就会 等同于 $XX{a} 我们提交   tsn = \ 绕过转义的限制 从而导致的注入
		}
		$db_field = 'eid,did,tsn,title,amount,comment';
		$this->db->query('INSERT INTO ' . $db_table2 . ' (' . $db_field . ') VALUES ' . $db_values); //进入查询