PHP云人才系统任意刷钱（附演示）

function dingdan_action(){
   if($_POST['price']){
    if($_POST['comvip']){
     $comvip=(int)$_POST['comvip'];
     $ratinginfo =  $this->obj->DB_select_once("company_rating","`id`='".$comvip."'");
     $price = $ratinginfo['service_price'];
     $data['type']='1';
    }elseif($_POST['price_int']){
     $price = $_POST['price_int']/$this->config['integral_proportion'];  //integral_proportion = 20 只是简单的相除，没有判断正负。
     $data['type']='2';
    }elseif($_POST['price_msg']){
     $price = $_POST['price_msg']/$this->config['integral_msg_proportion'];
     $data['type']='5';
    }else{
      $this->obj->ACT_layer_msg("参数不正确，请正确填写！",8,$_SERVER['HTTP_REFERER']);
    }
    $dingdan=mktime().rand(10000,99999); //订单生产的订单号，使用时间戳加上随机数。
    $data['order_id']=$dingdan;
    $data['order_price']=$price;
    $data['order_time']=mktime();
    $data['order_state']="1";
    $data['order_remark']=trim($_POST['remark']);
    $data['uid']=$this->uid;
    $data['rating']=$_POST['comvip'];
    $data['integral']=$_POST['price_int'];
    $id=$this->obj->insert_into("company_order",$data); //成功插入了数据库
    if($id){
     $this->obj->ACT_layer_msg("下单成功，请付款！",9,"index.php?c=payment&id=".$id);
    }else{
     $this->obj->ACT_layer_msg("提交失败，请重新提交订单！",8,$_SERVER['HTTP_REFERER']);
    }
   }else{
    $this->obj->ACT_layer_msg("参数不正确，请正确填写！",8,$_SERVER['HTTP_REFERER']);
   }
  }

if(!is_numeric($_POST['dingdan']))  //判断了是否为数字
 {
  die;
 }
 $userid=(int)$_COOKIE['uid'];
 $_POST['is_invoice']=(int)$_POST['is_invoice']; //无用
 $_POST['balance']=(int)$_POST['balance'];   //化为整数了，此参数只要存在就行了，随便提交
 $member_sql=$db->query("SELECT * FROM `".$db_config["def"]."member` WHERE `uid`='".$userid."' limit 1");
 $member=mysql_fetch_array($member_sql);
 if($member['username'] != $_COOKIE['username'] || $member['usertype'] != $_COOKIE['usertype']||md5($member['username'].$member['password'].$member['salt'])!=$_COOKIE['shell']){
  echo '登录信息验证错误，请重新登录！';die;
 }
 $sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='$_POST[dingdan]'");  //根据订单号查询order
 $row=mysql_fetch_array($sql);
 if($_POST['balance']&&$userid){  //正常登陆用户，随便提交balance参数即可
  $c_sql=$db->query("select `pay` from `".$db_config["def"]."company_statis` where `uid`='".$userid."'");
  $company_statis=mysql_fetch_array($c_sql);
  if($company_statis['pay']>=$row['order_price']){             //关键来了，判断用户余额是否大于订单，因为order_price 是负数，一定为true
   $up_sql=$db->query("update `".$db_config["def"]."company_statis` set `pay`=`pay`-'".$row['order_price']."' where `uid`='".$userid."'"); //此处直接相减了，负负得正！金钱增加。漏洞触发。
   mysql_fetch_array($up_sql);
 
   $up_order=$db->query("update `".$db_config["def"]."company_order` set `order_price`='0'".$invoice_title." where `order_id`='".$row['order_id']."'");  //这里不影响，后面都不影响。
   mysql_fetch_array($up_order);
   $price=$row['order_price'];
  }else{
   $price=$company_statis['pay'];
   $up_sql=$db->query("update `".$db_config["def"]."company_statis` set `pay`='0' where `uid`='".$userid."'");
   $up_sql_status=mysql_fetch_array($up_sql);
 
   $up_order=$db->query("update `".$db_config["def"]."company_order` set `order_price`=`order_price`-'".$price."'".$invoice_title." where `order_id`='".$row['order_id']."'");
   mysql_fetch_array($up_order);
  }
  $insert_company_pay=$db->query("insert into `".$db_config["def"]."company_pay`(order_id,order_price,pay_time,pay_state,com_id,pay_remark,type) values('".$row['order_id']."','-".$price."','".time()."','2','".$userid."','".$row['order_remark']."','2')");
  mysql_fetch_array($insert_company_pay);
  $new_sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='".$row['order_id']."'");
  $row=mysql_fetch_array($new_sql);
 }

在文件member/model/com.class.php中：
  function paylog_action(){
   include(CONFIG_PATH."db.data.php");
   $this->yunset("arr_data",$arr_data);
   $this->public_action();
 /*
 省略
 */
   }else{
    $urlarr=array("c"=>"paylog","page"=>"{{page}}");
    $pageurl=$this->url("index","index",$urlarr);
    $where="`uid`='".$this->uid."'";
    $where.=" and `order_price`>0 order by order_time desc";  //根据这个逻辑只显示了订单额大于0的项目，因此订单号需要我们去猜测。
    $this->get_page("company_order",$where,$pageurl,"10");
   }
 /*
 省略
 */
  }