这几天日了鬼了。后台老是被人登陆，查看日志发现，对方直接后台登陆界面，获取几次验证码后就直接登陆了。开始以为用户名密码泄露，改了密码之后发现对方还是闲庭信步般进入系统后台。后来怀疑可能是sql注入，在登陆界面加入了记录post数据，和相关的sql语句的记录语句。对方来了，还是闲庭信步般进入系统，好像后台登陆界面就不存在一样，而且没有记录到任何post数据，就像没有发送任何数据过来，就访问一下就登陆了。这个火大，但是后台的登陆处理代码看了上千遍了，没看出个花来，难道有新的0day漏洞？？？？？
thinkphp 版本为3.2.3

对方访问日志：/admin.php/Home/Login
/sncss/css/style.css
/sncss/js/jquery.js
/sncss/js/cloud.js
/admin.php/Home/login/verify
/sncss/images/light.png
/admin.php/Home/Login/logincl
/admin.php/Home/Login/logincl
/admin.php/Home/login/verify?0.7942123614313796
/admin.php/Home/Login/logincl
/admin.php/Home/Login
/sncss/js/cloud.js
/sncss/css/style.css
/sncss/js/jquery.js
/sncss/images/light.png
/admin.php/Home/login/verify
/admin.php/Home/Login/logincl
/admin.php/Home/login/verify?0.20844382581094267
/admin.php/Home/Login/logincl
/admin.php/Home/Login
/admin.php/Home/login/verify
/admin.php/Home/login/verify?0.8239541925707019
/admin.php/Home/Login/logincl         //登陆处理函数
/admin.php/Home/Index/main           //这里进入了后台界面，一阵强奸
/admin.php/Home/Index/top.html
/admin.php/Home/Index/left.html登陆处理函数public function logincl()
    {
        header("Content-Type:text/html; charset=utf-8");
        if (IS_POST) {
            $username = trim(I('post.account'));
            $pwd = trim(I('post.password'));
            $verCode = trim(I('post.verCode'));//驗證碼
            fh(I('post.account'));
            fh(I('post.password'));
            fh(I('post.verCode'));
            if (!$this->check_verify($verCode)) {
                die("<script>alert('驗證碼錯誤,請刷新驗證碼！');history.back(-1);</script>");
            } else {
                $user = M('member')->where(array('MB_username' => $username))->find();
                $sql = M("member")->getLastSql();
                fh($sql, true);

                if (!$user || $user['mb_userpwd'] != md5($pwd)) {
                    die("<script>alert('賬號或密碼錯誤,或被禁用！');history.back(-1);</script>");
                } else {

                    session('adminuser', $user['mb_username']);
                    session('adminqx', $user['mb_right']);
                    //cookie('uid2',$user[ue_id],array('expire'=>5,'prefix'=>'think_'));
                    $record1['date'] = date('Y-m-d H:i:s', time());
                    $record1['ip'] = I('post.ip');
                    $record1['user'] = $username;
                    $record1['leixin'] = 1;
                    M('drrz')->add($record1);
                    $_SESSION['logintime'] = time();
                    die("<script>alert('登入成功！');document.location.href='/admin.php/Home/Index/main';</script>");

                }
            }

        }

    }