WooYun.org

<?php
/**
 *
 * @ IonCube v7 Decoder By DoraemonPT
 *
 * @ Version  : 1,0,0,0
 * @ Author   : DoraemonPT
 * @ Release on : 19-08-2013
 * @ Website  : http://easytoyou.eu
 *
 **/
class SsoControl extends Control {
	function hello() {
		header( 'p3p: CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"' );
		session_unset(  );
		$base_passwd = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_0123456789';
		$base_len = strlen( $base_passwd );
		$len = 26;
		$sess_key = '';
		$i = 10;
		while ($i < $len) {
			$sess_key .= $base_passwd[rand(  ) % $base_len];
			++$i;
		}
		$url = $_REQUEST['url'] . '&r=' . $sess_key;
		$_SESSION['sess_key'] = $sess_key;
		header( 'Cache-Control: no-cache,no-store' );
		header( 'Location: ' . $url );
		exit(  );
	}
	function login() {
		if ($_SESSION['sess_key'] == '') {
			exit( 'error,sess_key is empty' );
		}
		$name = $_REQUEST['name'];
		$skey = daocall( 'setting', 'get', array( 'skey' ) );
		$str = $_REQUEST['r'] . $name . $_SESSION[sess_key] . $skey;
		md5( $str );
		$md5str = ;
		if (( strtolower( $md5str ) == $_REQUEST['s'] && $_REQUEST['s'] != '' )) {
			registerRole( 'vhost', $_REQUEST['name'] );
			$_SESSION['login_from'] = 'vhost';
			header( 'Location: index.php' );
			exit(  );
			return null;
		}
		exit( 'login failed' );
	}
}
?>
默认skey为空。所以可以伪造$_REQUEST['s'] 登陆任意用户。