WooYun.org

//#####################@ 购物车商品删除 @#####################//
	case 'cartdel':
		$money['order_productmoney'] = $money['order_wlmoney'] = $money['order_money'] = 0;
		if (pe_login('user')) {
			$result = $db->pe_delete('cart', array('user_id'=>$_s_user_id, 'product_id'=>$_g_product_id));//漏洞存在这里
		}
		else {
			$cart_list = unserialize($_c_cart_list);
			unset($cart_list[$_g_product_id]);
			$result = is_array($cart_list[$_g_product_id]) ? false : true;
			setcookie('cart_list', serialize($cart_list), 0, '/');
		}
		$cart_info = cart_info($cart_list);
		echo json_encode(array('result'=>$result, 'money'=>$cart_info['money']));
	break;

public function pe_delete($table, $where = '')
	{
		//处理条件语句
		$sqlwhere = $this->_dowhere($where);
		return $this->sql_delete("delete from `".dbpre."{$table}` {$sqlwhere}");
	}
protected function _dowhere($where)
	{
		if (is_array($where)) {
			foreach ($where as $k => $v) {
				if (is_array($v)) {
					$where_arr[] = "`{$k}` in('".implode("','", $v)."')";			
				}
				else {
					in_array($k, array('order by', 'group by')) ? ($sqlby = " {$k} {$v}") : ($where_arr[] = "`{$k}` = '{$v}'");
				}
			}
			$sqlwhere = is_array($where_arr) ? 'where '.implode($where_arr, ' and ').$sqlby : $sqlby;
		}
		else {
			$where && $sqlwhere = (stripos(trim($where), 'order by') === 0 or stripos(trim($where), 'group by') === 0) ? "{$where}" : "where 1 {$where}";
		}
		return $sqlwhere;
	}
public function sql_delete($sql)
	{
		$this->query($sql);
		$result = mysql_affected_rows();
		return $result > 0 ? $result : 0;
	}