WooYun.org

if(!defined('IN_UC')) {
	error_reporting(0);
	set_magic_quotes_runtime(0);
	
	defined('MAGIC_QUOTES_GPC') || define('MAGIC_QUOTES_GPC', get_magic_quotes_gpc());
	require_once 'config.inc.php';
	$_DCACHE = $get = $post = array();
	$code = @$_GET['code'];       //code=加密代码
	parse_str(_authcode($code, 'DECODE', UC_KEY), $get);  //到这里进行解密
	//var_dump($get);
	if(MAGIC_QUOTES_GPC) {
		$get = _stripslashes($get);  //不明白这里用意,解密后把反斜杠去掉
	}
	$timestamp = time();
	echo $timestamp - $get['time'];
	if($timestamp - $get['time'] > 3600) {  //time可控
		exit('Authracation has expiried');
	}
	if(empty($get)) {
		exit('Invalid Request');
	}
	$action = $get['action']; //action可控
	require_once 'uc_client/lib/xml.class.php';
	$post = xml_unserialize(file_get_contents('php://input'));
	if(in_array($get['action'], array('test', 'deleteuser', 'renameuser', 'gettag', 'synlogin', 'synlogout', 'updatepw', 'updatebadwords', 'updatehosts', 'updateapps', 'updateclient', 'updatecredit', 'getcreditsettings', 'updatecreditsettings'))) {
		/**
		require_once 'include/db_mysql.class.php';
		$GLOBALS['db'] = new dbstuff;
		$GLOBALS['db']->connect($dbhost, $dbuser, $dbpw, $dbname, $pconnect, true, $dbcharset);
		print_r($GLOBALS['db']);
		$GLOBALS['tablepre'] = $tablepre;
		unset($dbhost, $dbuser, $dbpw, $dbname, $pconnect);
		**/
		$uc_note = new uc_note();
		//file_put_contents('aa.txt','1');
		exit($uc_note->$get['action']($get, $post));
	} else {
		exit(API_RETURN_FAILED);
	}
} else {

function synlogin($get, $post) {
		$uid = $get['uid'];
		//$username = iconv('gbk','utf-8',$get['username']);
		//gbk版本论坛使用上行
		$username = $get['username'];
		//UTF8版本使用上行
		if(!API_SYNLOGIN) {
			return API_RETURN_FORBIDDEN;
		}
		$sql = "set names utf8";
		$this->dblink->query($sql);
		$sql = "SELECT * FROM ".DTH."user WHERE username = '{$username}'"; //注入点1
		$u = $this->dblink->fetch_first($sql);
		$args = array();
		if(!$u){  //提交个不存在的用户这里$u就为null
			$sql = "SELECT * FROM ".DTH."user_group WHERE groupdefault = '1'";
			$g = $this->dblink->fetch_first($sql);
			$grouid = $g['groupid'];
			$email = $username."@phpems.net";
			$pass = md5(rand(1000,9999));
			$sql = "INSERT INTO ".DTH."user (`username`,`useremail`,`userpassword`,`usergroupid`,`userregtime`,`userregip`) VALUES ('{$username}','{$email}','{$pass}','{$grouid}','".TIME."','".$this->_getClientIp()."')";   //username可控制，是解密后得到的内容 那么就可以直接添加一个管理员
			$this->dblink->query($sql);
			$args = array('sessionuserid'=>$this->dblink->insert_id(),'sessionpassword'=>$pass,'sessionip'=>$this->_getClientIp(),'sessiongroupid'=>$grouid,'sessionlogintime'=>TIME,'sessionusername'=>$username);
		}
		else
		$args = array('sessionuserid'=>$u['userid'],'sessionpassword'=>$u['userpassword'],'sessionip'=>$this->_getClientIp(),'sessiongroupid'=>$u['usergroupid'],'sessionlogintime'=>TIME,'sessionusername'=>$u['username']);
		if(!$args['sessiontimelimit'])$args['sessiontimelimit'] = TIME;
    	if(!$this->sessionid)$this->_getSessionId();
    	$args['sessionid'] = $this->sessionid;
    	$args['sessiontimelimit'] = TIME;
    	$data = array('session',$args);
    	$sql = $this->_makeReplace($data);
    	$this->dblink->query($sql);