ell附利用exp

別の1種の生

正文：

关键文件：/mod/ajax_mod.php

if (!empty($_POST)) {
  $_POST = Char_cv($_POST);
  if ($db_charset != 'utf-8') {
    require_once(R_P.'mod/charset_mod.php');
    foreach ($_POST as $key => $value) {
      ${'utf8_'.$key} = $value;
      ${$key} = convert_charset('utf-8',$db_charset,$value);
    }
  } else {
    foreach ($_POST as $key => $value) {
      ${'utf8_'.$key} = ${$key} = $value; //变量覆盖了
    }
  }
}


变量覆盖导致注入漏洞

重点文件：/ajax.php



if ($action=='vote') {
  !$winduid && exit('not_login');//变量覆盖绕过
  (int)$votenum < 1 && exit('erro_voteid');//变量覆盖绕过
  $voteitem = array();
  $query = $db->query("SELECT id,voteduid FROM pw_voteitem WHERE vid='$vid'");//漏洞来了，进入query()函数
  while ($rt = $db->fetch_array($query)) {
    strpos(",$rt[voteduid],",",$winduid,")!==false && exit('have_voted');
    $voteitem[$rt['id']] = $rt['voteduid'];
  }