WooYun.org

$pararr = explodestpar( $_REQUEST['par'] );


$userpriv = $pararr['userpriv'];


...


if ( $pararr['view_type'] == 0 )


{


				unset( $deptnameutf8 );


				unset( $action );


				unset( $src );


				unset( $target );


				unset( $icon );


				$usql = "\r\n\t\t\tSELECT * FROM USER,USER_PRIV \r\n\t\t\t\tWHERE USER.USER_PRIV=".$userpriv." \r\n\t\t\t\tAND USER.USER_PRIV=USER_PRIV.USER_PRIV \r\n\t\t\t\tORDER BY PRIV_NO,USER_NAME\r\n\t\t\t";


				$urs = exequery( $connection, $usql );

function explodeStPar( $enpar )


{


				$depar = base64_decode( $enpar );


				$arrpar = explode( "|", $depar );


				if ( !is_array( $arrpar ) )


				{


								return false;


				}


				$i = 0;


				for ( ;	$i < sizeof( $arrpar );	++$i	)


				{


								$strpar = $arrpar[$i];


								$tmparr = explode( ":", $strpar );


								$j = 0;


								for ( ;	$j < sizeof( $tmparr );	++$j	)


								{


												if ( $j == 0 )


												{


																preg_match( "/\\[([a-z0-9-_].+)\\]/i", $tmparr[$j], $exp );


																$par = $exp[1];


												}


												else


												{


																preg_match( "/\\[(.*)\\]/i", $tmparr[$j], $exp );


																$val = $exp[1];


												}


								}


								if ( trim( $par ) != "" )


								{


												$rearr[$par] = $val;


								}


				}


				return $rearr;


}