dedecms v5.1 WriteBookText() code injection vul
来源:Ph4nt0m Google Group
by Flyh4t@126.com
QQ:378367942
<coolcode lang="php">
\include\inc_bookfunctions.php
---------------------------------------------------
……
function WriteBookText($cid,$body)
{
global $cfg_cmspath,$cfg_basedir;
$ipath = $cfg_cmspath."/data/textdata";
$tpath = ceil($cid/5000);
if(!is_dir($cfg_basedir.$ipath)) MkdirAll($cfg_basedir.$ipath,$GLOBALS['cfg_dir_purview']);
if(!is_dir($cfg_basedir.$ipath.'/'.$tpath)) MkdirAll($cfg_basedir.$ipath.'/'.$tpath,$GLOBALS['cfg_dir_purview']);
$bookfile = $cfg_basedir.$ipath."/{$tpath}/bk{$cid}.php";
$body = "<"."?php\r\n".$body."\r\n?".">";
@$fp = fopen($bookfile,'w');
@flock($fp);
@fwrite($fp,$body);
@fclose($fp);
}
……
</coolcode>
---------------------------------------------------
\member\story_add_content_action.php
---------------------------------------------------
<coolcode lang="php">
……
WriteBookText($arcID,addslashes($body));
……
</coolcode>
---------------------------------------------------
找了个好看的站测试了一下
http://www.admin5.com/data/textdata/1/bk1.php
文件是写上去了,可惜这个目录不支持php,fuck
贵站已经连好111
kevin skier's blog
www.kshacker.cn
谢谢咯``
主要是这句:
$body = "";
PS:加个友情链接吧http://www.100631.com/blog 采采的BLOG
主要有这个东东php exit();