phpyun设计缺陷可用别的账户money付款，清空别的账户money为0

### 简要描述： 后台在处理订单的时候，直接获取cookie中的uid，此uid可以伪造成他人的uid，导致可用他人的money付款。 经过测试，虽然自己并不能获得支付成功的积分，但是可以扣除他人账户余额。 ### 详细说明： 漏洞文件\api\tenpay\index.php: ``` $sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='$_POST[dingdan]'"); $row=mysql_fetch_array($sql); //通过订单编号获取点单价格 $userid=(int)$_COOKIE['uid']; //获取cookie中的uid ,此uid可以伪造成别人的uid !!!! if($_POST['balance']&&$userid){ $c_sql=$db->query("select `pay` from `".$db_config["def"]."company_statis` where `uid`='".$userid."'"); //通过伪造的uid读取出别人的账户余额 $company_statis=mysql_fetch_array($c_sql); if($company_statis['pay']>=$row['order_price']){ //如果账户余额大于付款金额 $up_sql=$db->query("update `".$db_config["def"]."company_statis` set `pay`=`pay`-'".$row['order_price']."' where `uid`='".$userid."'"); //通过伪造的uid付款 mysql_fetch_array($up_sql); $up_order=$db->query("update `".$db_config["def"]."company_order` set `order_price`='0'".$invoice_title." where `order_id`='".$row['order_id']."'"); mysql_fetch_array($up_order); $price=$row['order_price']; }else{ //如果账户余额小于付款金额 $price=$company_statis['pay']; $up_sql=$db->query("update `".$db_config["def"]."company_statis` set `pay`='0' where `uid`='".$userid."'"); //直接清空账户余额位0 $up_sql_status=mysql_fetch_array($up_sql); $up_order=$db->query("update `".$db_config["def"]."company_order` set `order_price`=`order_price`-'".$price."'".$invoice_title." where `order_id`='".$row['order_id']."'"); mysql_fetch_array($up_order); } ``` ### 漏洞证明： 注册一个充了值的账户test2,可用余额为100: [<img src="https://images.seebug.org/upload/201408/1915513208ea1755f4b0294afc05d3f89e47db36.jpg" alt="QQ截图20140819152522.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/1915513208ea1755f4b0294afc05d3f89e47db36.jpg) 注册一个账户test5,提交一个订单： [<img src="https://images.seebug.org/upload/201408/191553423554786b7c5ff78eb4df22449a6f4f89.jpg" alt="QQ截图20140819152701.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/191553423554786b7c5ff78eb4df22449a6f4f89.jpg) [<img src="https://images.seebug.org/upload/201408/19155442a1b39aac1d2c811d2e2130cb31c4b495.jpg" alt="QQ截图20140819152722.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/19155442a1b39aac1d2c811d2e2130cb31c4b495.jpg) 付款时抓包将cookie中uid改为test2的uid: [<img src="https://images.seebug.org/upload/201408/19155813d98252025ecc8d5f04b9a7f07c6d0873.jpg" alt="QQ截图20140819155751.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/19155813d98252025ecc8d5f04b9a7f07c6d0873.jpg) 通过test2付款成功: [<img src="https://images.seebug.org/upload/201408/1915595916b9ea0aa95f414fdc61a23785ed5a84.jpg" alt="QQ截图20140819155934.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/1915595916b9ea0aa95f414fdc61a23785ed5a84.jpg) 如果账户余额小于付款金额会重置账户余额为0,test5提交一个价格很高的订单让test2付款 [<img src="https://images.seebug.org/upload/201408/19160319e0053fe77ce7f1fa36f549d528821513.jpg" alt="QQ截图20140819160310.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/19160319e0053fe77ce7f1fa36f549d528821513.jpg) 同样抓包修改uid为test2的uid，结果 [<img src="https://images.seebug.org/upload/201408/19160544be5d90f3ef98638ddfd7f9982ac3833b.jpg" alt="QQ截图20140819160527.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/19160544be5d90f3ef98638ddfd7f9982ac3833b.jpg) test2的消费记录: [<img src="https://images.seebug.org/upload/201408/19160820a1cce7dc5f579e5858ccbe8f466beec2.jpg" alt="QQ截图20140819160741.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/19160820a1cce7dc5f579e5858ccbe8f466beec2.jpg)