WooYun.org

$act = !empty($_REQUEST['act']) ? trim($_REQUEST['act']) : 'enter';


$smarty->assign('header_nav',"getpass");


if ($act=='enter')


{


        $smarty->assign('title','找回密码 - '.$_CFG['site_name']);


        $token=substr(md5(mt_rand(100000, 999999)), 8,16); //生成token


        $_SESSION['getpass_token']=$token; //保存到session中


        $smarty->assign('token',$token); //通过smarty 显示到前台 我们可以看到


        $smarty->display('user/get-pass.htm');


}

elseif($act == "get_pass_save")


{


        global $QS_pwdhash;


        if(empty($_POST['token']) || $_POST['token']!=$_SESSION['getpass_token']) //这个值上面可以获得得到 这就绕过了


        {


                $link[0]['text'] = "重新找回密码";


                $link[0]['href'] = "?act=enter";


                showmsg("找回密码失败，非正常链接",0,$link);


        }


        $uid=intval($_POST['uid']);//uid可控 遍历uid可重置任意账号密码


        $password=$_POST['password']?trim($_POST['password']):showmsg("请输入密码！",1); 


        $userinfo=get_user_inid($uid);


        if(empty($userinfo))


        {


                $link[0]['text'] = "重新找回密码";


                $link[0]['href'] = "?act=enter";


                showmsg("修改密码失败",0,$link);


        }


        $password_hash=md5(md5($password).$userinfo['pwd_hash'].$QS_pwdhash);


        $setsqlarr['password']=$password_hash;


        $rst=$db->updatetable(table('members'),$setsqlarr,array("uid"=>$userinfo['uid']));//更改密码


        if($rst)


        {


                header("Location: ?act=get_pass_sucess"); 


        }       


        else


        {


                showmsg("设置新密码失败！",1);


        }


}