Ecshop 2.72 lib_payment.php 注入

213         $payment  = get_payment($_GET['code']);
214         $seller_email = rawurldecode($_GET['seller_email']);
215         $order_sn = str_replace($_GET['subject'], '', $_GET['out_trade_no']);
216         $order_sn = trim($order_sn);
217
218         /* 检查支付的金额是否相符 */
219         if (!check_money($order_sn, $_GET['total_fee']))
220         {
221             return false;
222         }

109 function check_money($log_id, $money)
110 {
111     $sql = 'SELECT order_amount FROM ' . $GLOBALS['ecs']->table('pay_log') .
112               " WHERE log_id = '$log_id'";
113     $amount = $GLOBALS['db']->getOne($sql);
114
115     if ($money == $amount)
116     {
117         return true;
118     }
119     else
120     {
121         return false;
122     }
123 }