【0day】DedeCMS 织梦网站内容管理系统

memberindex_do.php：

else if($fmdo=='login')
//   http://127.0.0.1/member/index_do.php?fmdo=login&dopost=login
就来到这步了
{
    //用户登录
    if($dopost=="login")
    {
        if(!isset($vdcode))
        {
            $vdcode = '';
        }
        $svali = GetCkVdValue();
        if(preg_match("/2/",$safe_gdopen)){
            if(strtolower($vdcode)!=$svali || $svali=='')
            {
                ResetVdValue();
                ShowMsg('验证码错误！', '-1');
                exit();
            }
           
        }
        if(CheckUserID($userid,'',false)!='ok')
        {
            ShowMsg("你输入的用户名 {$userid} 不合法！","-1");
            exit();
        }
        if($pwd=='')
        {
            ShowMsg("密码不能为空！","-1",0,2000);
            exit();
        }

        //检查帐号
        $rs = $cfg_ml->CheckUser($userid,$pwd);       
         //检测用户名密码  这里不会出现提示错误  因为还要运行下面代码
        #api{{
        if(defined('UC_API') && @include_once DEDEROOT.'/uc_client/client.php')
        {
            //苛刻条件之一  已经整合DZ 并安装了UCCLIENT这个插件
            //检查帐号
            list($uid, $username, $password, $email) = uc_user_login($userid, $pwd);
//登录DEDECMS的同时也登录DZ
            if($uid > 0) {
                $password = md5($password);
                //当UC存在用户,而CMS不存在时,就注册一个   
                if(!$rs) {   //如果DEDECMS登录不成功
                    //会员的默认金币
                    $row = $dsql->GetOne("SELECT `money`,`scores` FROM `#@__arcrank` WHERE `rank`='10' ");
                    $scores = is_array($row) ? $row['scores'] : 0;
                    $money = is_array($row) ? $row['money'] : 0;
                    $logintime = $jointime = time();
                    $loginip = $joinip = GetIP();
                    $res = $dsql->ExecuteNoneQuery("INSERT INTO #@__member SET `mtype`='个人',`userid`='$username',`pwd`='$password',`uname`='$username',`sex`='男' ,`rank`='10',`money`='$money', `email`='$email', `scores`='$scores', `matt`='0', `face`='',`safequestion`='0',`safeanswer`='', `jointime`='$jointime',`joinip`='$joinip',`logintime`='$logintime',`loginip`='$loginip';");

//漏洞就这样形成了  当DZ的用户全在的话 就会建立到DEDECMS里