pw6的一个url转跳[BUG]

Showmsg("hack_error");
}
define('H_P',R_P."hack/$H_name/");

我们看看ObHeader()在global.php里:
function ObHeader($URL){
global $db_obstart,$db_bbsurl,$db_htmifopen;
if($db_htmifopen && strtolower(substr($URL,0,4))!='http'){
$URL="$db_bbsurl/$URL";
}
ob_end_clean();
if($db_obstart){//可惜phpwind不让全局变量了[见我上个blog],要不就可以进header()

header("Location: $URL");exit;
} else{
ob_start();
echo "<meta http-equiv='refresh' content='0;url=$URL'>";exit;//这里访问了我们的url
}
}

POC:
http://www.phpwind.net/hack.php?H_name=http://www.google.com