WooYun.org

<?php


require_once 'config/config.php';


require_once 'include/template.php';


require_once 'include/func.php';


require_once 'include/right.php';


require_once 'include/dbfunc.php';


require_once 'include/sms_func.php';


require_once 'include/func_login.php';


include_once "include/$AUTH_MODULE";





session_start();





$F_sid = trim($_REQUEST['F_sid']);





if(isset($_REQUEST['F_sms_send'])) { //当f_sms_send条件存在时，触发


	$email		= $_COOKIE['ANY_EMAIL'];  //无过滤从cookie中获取


	$telstr 	= trim($_REQUEST['F_tel']);


	$tmp = explode(":",$telstr);


	$send_tel 	= $tmp[0];


	$send_pass 	= '';





	$sql = "SELECT id,maildir FROM user WHERE id='".$email."'";//直接传入sql语句当中执行，造成sql注入漏洞


	$res = db_query($sql);


	$row = db_fetch($res);


	if(!empty($row['id'])) {


		$smsfile = $row['maildir'].'/sms.config';


		if(file_exists($smsfile)) {


			$fstr = @file($smsfile);


			$farr = explode(",",trim($fstr[0]));


			$tel_arr[$farr[0]] = $farr[2];


			$send_pass = $tel_arr[$send_tel];


		}


	}





	$recv_tel 	= trim($_REQUEST['F_phone']);


	$sms_msg	= trim($_REQUEST['F_msg']);