精迅 CMS 新闻 内容管理系统漏洞

看代码：

case 'getpw':
    $showsubmenu = 0;
    $log_status && showmsg($lang['login_already'], $forward);
    if (isset($_POST['submit'])) {
        $msg = $_POST['hash'] == $ghash ? '' : $lang['hash_error'];
        if ($set_captcha[1]) {
            $msg or check_captcha($_POST['captcha']) or $msg = $lang['checkcode_error'];
        }
        $username = trim($_POST['username']);
        $email = trim($_POST['email']);
        if (!($member -> checkuser($username, 0) && $member -> checkemail($email, 0))) { // 0表示不检测是否存在
            showmsg($member -> info);
        }
        $r = $member -> get(0, '`userid`,`email`,`question`,`answer`', "username='$username'");
        if ($r) {
            $answer = shtmlspecialchars($_POST['answer']);
            if ($r['email'] != $email) showmsg($lang['email_name_error']);
            elseif ($r['question'] && $answer != $r['answer']) showmsg($lang['answer_error']);
            else {
                $newpwd = substr(gethash($TIME . $IP), 6, 12);
                $member -> modipwd($r['userid'], '', $newpwd, $newpwd, 1) or showmg($member -> info);
                include JXCMS_ROOT . 'include/mail.func.php';
                $mail_subject = &$lang['getpw_emailtitle'];
                $mail_content = sprintf($lang['mail_body'], $username, $lang['your_new_password'] . $newpwd, $set_ceomail, $set_contact);
                if ($set_sendtype == 'mail') {
                    basic_sendmail($email, $set_ceomail, $set_name, $mail_subject, $mail_content, 'html');
                } elseif ($set_sendtype == 'nmail') {
                    nmail($email, $set_ceomail, $set_name, $mail_subject, $mail_content, 'html');
                } elseif ($set_sendtype == 'smtp') {
                    smtp_sendmail($email, $set_ceomail, $set_name, $mail_subject, $mail_content, 'html');
                }
                showmsg($lang['getpw_sucess'], 'login.php', 3000);
            }
        } else showmsg($lang['email_name_error']);
    }
    include tpl('getpw');
    break;

看 gethash：

function gethash($str) {
    $str = md5($str . $GLOBALS['set_sid']);
    $tmp = str_split($str, 1);
    $tmp = array_unique($tmp);
    return implode ('', $tmp);
    }