WooYun.org

<?php
ini_set('session.cookie_domain', ".iask.sina.com.cn");
error_reporting(E_ALL);
ini_set('display_errors', 1);
define('COOKIE_DOMAIN', '.admin.iask.sina.com.cn');
include('/data4/adminManage/conf/adminconf.php');
session_start();
$appmap = array(
	1000=>'d420915821e92b6559478b446445d172',
	1001=>'d420915821e92b6559478b446445d171',
);
$appuser = array(
	1000=>array('user'=>'weibo_zhishi', 'pw'=>'123456'),
	1001=>array('user'=>'baby_zhishi', 'pw'=>'123456'),
);
$appto = array(
	1000=>'http://admin.iask.sina.com.cn/audit/ishare_audit.php?action=indexapp',
	1001=>'http://admin.iask.sina.com.cn/audit/ishare_audit.php?action=indexapp',
);
$appgroup = array(
	1000=>array(7, 8, 10),
	1001=>array(16),
);
$appid = isset($_GET['appid']) ? intval($_GET['appid']) : 0;
$sign = isset($_GET['sign']) ? $_GET['sign'] : '';
$time = isset($_GET['time']) ? intval($_GET['time']) : 0;
$ip = isset($_GET['ip']) ? $_GET['ip'] : '';
$user = isset($_GET['user']) ? $_GET['user'] : '';
//下面的判断可以通过设置好参数来绕过，appid这里使用1000
if(!$appid||!$sign||!$time||!$ip||!$user||!isset($appmap[$appid])||!isset($appuser[$appid])) {
	exit('1001');
}
//time()函数，底下的exit注释掉了 - -！
if($time<time()-10*60) {
	//exit('1002');
}
$rip = lip::get_real_ip();
//底下的exit注释掉了 - -！
if($rip!=$ip) {
	//exit('1003');
}
error_log($rip.'-'.$ip."\n", 3, '/tmp/apip.log');
//这里可以自己伪造了~~~222333~~~
$sign_me = substr(md5($appid.$user.$time.$ip.$appmap[$appid]), 3, 16);
if($sign_me!=$sign) {
	exit('1004');
}
$username = $appuser[$appid];
global $db_admin;
$userDB = new admin_userDB($db_admin);
$rs = $userDB->check_password($appuser[$appid]['user'], $appuser[$appid]['pw'],true);
//设置cookie字段说明可以登录
if(is_array($rs)) {
	set_cookie("userid"      , $rs['uid']);
	set_cookie("username"    , $rs['uname']);
	set_cookie("name"        , 'supe');
	set_cookie("gname"       , $rs['gname']);
	set_cookie("gid"         , $rs['gid']);
	set_cookie("menuids_admin"     , $rs['menuid']);
	if(!$_COOKIE['lastlogintime']) {
		$_COOKIE['lastlogintime'] = date('Y-m-d H:i:s');
		set_cookie("lastlogintime" , $_COOKIE['lastlogintime']);
	}
} else {
	exit('1005');
}
$_SESSION['audit']['app']['username'] = $user;
$_SESSION['audit']['app']['group'] = $appgroup[$appid];
$result = 1000;
if(isset($_GET['location'])&&$_GET['location']==1) {
	$result = "<script>window.location.href='{$appto[$appid]}'</script>";
}
exit("$result");
function set_cookie($cname , $cval) {
	setcookie($cname , $cval , 0 , "/" , COOKIE_DOMAIN);
}