Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
	private function initSession(){
		$this->apiSignCheck();
		// 入口不处理cookie,兼容服务器启用了全GET缓存情况(输出前一次用户登录的cookie,导致账号登录异常)
		$action= strtolower(ACTION);
		if( $action == 'user.index.index' || 
		    $action == 'user.view.call'){
			Cookie::disable(true);
		}
		
		$systemPassword = Model('SystemOption')->get('systemPassword');
		$accessToken = isset($_REQUEST['accessToken']) ? $_REQUEST['accessToken'] : '';
		if($accessToken && strlen($accessToken) < 500){
			$pass = substr(md5('kodbox_'.$systemPassword),0,15);
			$sessionSign = Mcrypt::decode($accessToken,$pass);
			if(!$sessionSign){show_json(LNG('common.loginTokenError'),ERROR_CODE_LOGOUT);}
			$this->initAccessToken();
			Session::sign($sessionSign);
		}
		
		if(!Session::get('kod')){
			Session::set('kod',1);
			if(!Session::get('kod')){show_tips(LNG('explorer.sessionSaveError'));}
		}
		// 注意: Session设置sessionid的cookie;两个请求时间过于相近,可能导致删除cookie失败的问题;(又有sessionid请求覆盖)
		// 设置csrf防护;
		if(!Cookie::get('CSRF_TOKEN')){Cookie::set('CSRF_TOKEN',rand_string(16));}
	}