### 简要描述： EasyTalk越权查看任意用户的消息 ### 详细说明： 出现问题的代码文件路径 : easytalk/Home/Lib/Action/ImAction.class.php 代码加载时，没要求登录 ``` public function _initialize() { parent::init(); } ``` 出现问题的代码在这里 ``` //获得历史聊天记录 public function getDayRecord() { $uid=intval($_POST['user_id']); $user=M('Users')->where("user_id='$uid'")->find(); if ($user) { $info=getsubstr($user['user_info'],0,50); $info=$info?$info:L('nothing_write'); $data = D('MessagesView')->where("(senduid='".$this->my['user_id']."' AND sendtouid='$uid') OR (senduid='$uid' AND sendtouid='".$this->my['user_id']."')")->order("message_id DESC")->limit(10)->select(); if ($data) { $aCent=A('Content'); foreach ($data as $val) { $val['messagebody']=$aCent->ubb($val['messagebody']); $val['sendtime']=timeop($val['sendtime']); $msg[]=$val; } } //标记已读 if ($this->my['priread']>0) { M('Messages')->where("senduid='$uid' AND sendtouid='".$this->my['user_id']."'")->setField('isread',1); $count=M('Messages')->where("sendtouid='".$this->my['user_id']."' AND...
### 简要描述： EasyTalk越权查看任意用户的消息 ### 详细说明： 出现问题的代码文件路径 : easytalk/Home/Lib/Action/ImAction.class.php 代码加载时，没要求登录 ``` public function _initialize() { parent::init(); } ``` 出现问题的代码在这里 ``` //获得历史聊天记录 public function getDayRecord() { $uid=intval($_POST['user_id']); $user=M('Users')->where("user_id='$uid'")->find(); if ($user) { $info=getsubstr($user['user_info'],0,50); $info=$info?$info:L('nothing_write'); $data = D('MessagesView')->where("(senduid='".$this->my['user_id']."' AND sendtouid='$uid') OR (senduid='$uid' AND sendtouid='".$this->my['user_id']."')")->order("message_id DESC")->limit(10)->select(); if ($data) { $aCent=A('Content'); foreach ($data as $val) { $val['messagebody']=$aCent->ubb($val['messagebody']); $val['sendtime']=timeop($val['sendtime']); $msg[]=$val; } } //标记已读 if ($this->my['priread']>0) { M('Messages')->where("senduid='$uid' AND sendtouid='".$this->my['user_id']."'")->setField('isread',1); $count=M('Messages')->where("sendtouid='".$this->my['user_id']."' AND isread=0")->count(); if ($count==0) { M('Users')->where("user_id='".$this->my['user_id']."'")->setField('priread',0); } } echo json_encode(array('userinfo'=>$info,'msg'=>$msg)); } else { echo 'null'; } } ``` 只需post user_id (用户的ID)就可以查看用户的消息 [<img src="https://images.seebug.org/upload/201404/03054520d7ca0e3e880e01181d19187096a96ab6.png" alt="3.PNG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201404/03054520d7ca0e3e880e01181d19187096a96ab6.png) ### 漏洞证明： 都在上面了
