WooYun.org

if (isset($_POST['del']) && !empty($_POST['tradeid'])) {
    $tRes = $trade->del($_POST['tradeid'], "member_id = ".$the_memberid);
    if($tRes) $pdb->Execute("DELETE from {$tb_prefix}tradefields WHERE member_id={$the_memberid} AND trade_id IN (".implode(",",$_POST['tradeid']).")");//注入1:没有过滤，也没有引号保护，直接进入sql语句
}
if(isset($_POST['refresh'])){
    if (!empty($_POST['refresh']) && !empty($_POST['tradeid'])) {
        $vals = array();
        $pre_submittime = $pdb->GetOne("select max(submit_time) from {$tb_prefix}trades where member_id=".$the_memberid);
        if ($pre_submittime>($time_stamp-$tMaxDay*86400)) {
            flash("allow_refresh_day");
        }
        $vals['submit_time'] = $time_stamp;
        $vals['expire_days'] = 10;
        $vals['expire_time'] = $time_stamp+(24*3600*$vals['expire_days']);
        $conditions[]= "status='1'";
        $ids = implode(",", $_POST['tradeid']);//注入2 ，同上
        $conditions[]= "id in (".$ids.")";
        $condition = implode(" AND ", $conditions);
        $sql = "update ".$trade->getTable()." set submit_time=".$time_stamp.",expire_days=10,expire_time=".$vals['expire_time']." where ".$condition;
        $result = $pdb->Execute($sql);
        if ($result) {
            flash("success");
        }else{
            flash("action_failed");
        }
    }
}

if (isset($_POST['delete'])) {
    $deleted = false;
    if (is_array($_POST['id'])) {  //注入3
        $ids = "(".implode(",", $_POST['id']).")"; //也没有引号保护
        $deleted = $pdb->Execute("DELETE FROM {$tb_prefix}spacelinks WHERE member_id={$the_memberid} AND id IN $ids");
        if($deleted){
            flash("success");
        }else{
            flash();
        }
    }else{
        flash("no_data_deleted");
    }
}