WooYun.org

>>>>/**/无关代码省略/**/
 define('IN_CUTECMS', true);
 if(!file_exists("include/install.lock")) {
	 header("location:install/");exit;
 }
 require_once('include/helper.php');
 require_once('include/generate_static.inc.php');   //包含文件
>>>>/**/无关代码省略/**/
	 if($staticUrl && $staticUrl!='index') {    
		 if(preg_match("/^(.*)_page([0-9]{1,})$/i",   $staticUrl)) {
		   $url = substr($staticUrl, 0, strpos($staticUrl, "_page")).".html";
		   $staticUrlRow = getStaticUrlRow($db, $url);
		   $action = $staticUrlRow['action'];
		   $urlChannelId = $urlContentId = $staticUrlRow['rid'];
		   $urlPageNum = substr($staticUrl, strpos($staticUrl, "_page")+5);
		 }
		 
		 else {
			 $url = $staticUrl.".html";
			 $staticUrlRow = getStaticUrlRow($db, $url);  //发现带入了数据库查询，看看getStaticUrlRow函数
	         if(!$staticUrlRow) {
			   $pathPartsArr = pathinfo($url);
              
			   $staticPathArr = explode("/", $pathPartsArr['dirname']);
	           $staticChannelHtmlName = array_pop($staticPathArr);
>>>>/**/无关代码省略/**/
//跟入helper.php
require_once( BASE."lang.inc.php" );
require_once( BASE."base.inc.php" );
require_once( BASE."validate.inc.php" );
require_once( BASE."elements.inc.php" );
require_once( BASE."template.inc.php" );
//继续跟入base.inc.php
function getStaticUrlRow( $db, $url = "", $rid = "" )
{
				$sql = "SELECT * FROM ".PREFIX."static_url WHERE 1";
				if ( $url ) //带入查询没有任何过滤
				{
								$sql .= " AND url = '".$url."'";
				}
				if ( $rid )
				{
								$sql .= " AND rid = ".$rid;
				}
				$sql .= " LIMIT 1";
				$re = $db->getRow( $sql );
				return $re;
}
//以为把文件加密了，就能把漏洞给修补？作者太2了吧
 
>>>>/**/无关代码省略/**/
http://127.0.0.1/cutecms_free_v3.5/index.php?staticUrl=[sql]