LOW

源码

<?php

if( isset( $_GET[ 'Change' ] ) ) {
    // Get input
    $pass_new  = $_GET[ 'password_new' ];
    $pass_conf = $_GET[ 'password_conf' ];

    // Do the passwords match?
    if( $pass_new == $pass_conf ) {
        // They do!
        // 连接数据库的关键字符串，这是
        // 1.验证全局的连接字符$GLOBALS["___mysqli_ston"]是否存在
        // 2.验证$GLOBALS["___mysqli_ston"]是否为true(三木运算符)
        //      1.是，则使用mysqli_real_escape_string对新密码进行转义，预防注入攻击
        //      2.否，触发trigger_error用户自定义错误信息检测是否存在，无论是否存在都返回 ""
        $pass_new = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass_new ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
        // 加密
        $pass_new = md5( $pass_new );

        // Update the database
        // 定义SQL查询语句
        // emmmmmm……没有身份判断逻辑，直接修改了密码(漏洞，致命错误)
        $insert = "UPDATE `users` SET password = '$pass_new' WHERE user = '" . dvwaCurrentUser() . "';";
        
        // 数据库查询脚本
        // mysqli_query返回执行结果：是则返回执行结果，否则返回die报错信息
        $result = mysqli_query($GLOBALS["___mysqli_ston"],  $insert ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

        // Feedback for the user
        echo "<pre>Password Changed.</pre>";
    }
    else {
        // Issue with passwords matching
        echo "<pre>Passwords did not match.</pre>";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>