WooYun.org

$sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='$_POST[dingdan]'");





$row=mysql_fetch_array($sql); //通过订单编号获取点单价格





$userid=(int)$_COOKIE['uid']; //获取cookie中的uid ,此uid可以伪造成别人的uid !!!!








if($_POST['balance']&&$userid){


	$c_sql=$db->query("select `pay` from `".$db_config["def"]."company_statis` where `uid`='".$userid."'"); //通过伪造的uid读取出别人的账户余额


	$company_statis=mysql_fetch_array($c_sql);


	if($company_statis['pay']>=$row['order_price']){ //如果账户余额大于付款金额


		$up_sql=$db->query("update `".$db_config["def"]."company_statis` set `pay`=`pay`-'".$row['order_price']."' where `uid`='".$userid."'"); //通过伪造的uid付款


		mysql_fetch_array($up_sql);





		$up_order=$db->query("update `".$db_config["def"]."company_order` set `order_price`='0'".$invoice_title." where `order_id`='".$row['order_id']."'");


		mysql_fetch_array($up_order);


		$price=$row['order_price'];


	}else{ //如果账户余额小于付款金额


                


		$price=$company_statis['pay'];


		$up_sql=$db->query("update `".$db_config["def"]."company_statis` set `pay`='0' where `uid`='".$userid."'"); //直接清空账户余额位0


		$up_sql_status=mysql_fetch_array($up_sql);





		$up_order=$db->query("update `".$db_config["def"]."company_order` set `order_price`=`order_price`-'".$price."'".$invoice_title." where `order_id`='".$row['order_id']."'");


		mysql_fetch_array($up_order); 


	}