WooYun.org

$uid=$_GET["uid"];
$uid6=$_GET["uid6"];
if($fd=popen("/srun3/bin/online_user -".$ipv." -f ".$uid, "r"))//命令执行漏洞，无需登录
{
    $content=fread($fd, 1024);
    fclose($fd);
}
$array=explode("\t",$content);
if($uid6)
{
    if($fd=popen("/srun3/bin/online_user -6 -f ".$uid6, "r"))//命令执行漏洞，无需登录
    {
        $content="";
        $content=fread($fd, 1024);
        fclose($fd);
    }
    $array1=explode("\t",$content);
}

switch($_GET["action"])
{
case "drop_user1": //强制下线某个帐号的所有用户，无需登录，无线管理帐号
        if($_GET["ipv"]=="ipv4")
        {
            $pfd=popen("/srun3/bin/online_user -4 -d ".$_GET["uname1"], "r");    
        }
        else
        {
            $pfd=popen("/srun3/bin/online_user -6 -d ".$_GET["uname1"], "r");    
        }        
        $con = fread($pfd, 128);
        echo $con;
        pclose($pfd);
        break;

case "index_edit":
        $contents = urldecode($_POST["con"]);
        file_put_contents("/srun3/etc/msg.conf", $contents);
        $temp=file_get_contents("/srun3/web/templets/index_old.html");                
        $temp=str_replace("{:message:}", $contents, $temp);
        file_put_contents("/srun3/web/index_old.html", $temp);
        
        if(is_file("/srun3/web/templets/index.html"))
        {
            //写入公告
            $eidolon=new Eidolon("templets/index.html");
            $eidolon->setBlock("tr");
            //$temp=file_get_contents("/srun3/web/templets/login_dz.html");                
            //$temp=str_replace("{:message:}", $contents, $temp);            
            $message=$contents;

case "set_passwd":
        //修改内存中的密码
        $command="/srun3/bin/set_user passwd ".$_GET["uname"]." ".urldecode($_GET["pass"]);//修改任意用户的密码
        
        $fp=popen($command, "r");
        if($fp)
        {
            $con=fread($fp, 24);
            echo $con;
            pclose($fp);
        }    
        break;

public function prints() {
        global $ts,$action,$go,$page, $id;//$id等这些变量都是用户可控的
        $data_where =array (
                'check_out_id' => $id,
                'type' => 'bills',
                'user_login_name'=>$_SESSION['user_login_name']
        );
        $list =$this->model->get_list ( $this->model->get_index_where ( $data_where ), 0, 1 );//注入
        $data = $list [0];
        $data ['title'] = "用户帐单";
        parent::$templates->assign ( 'list', $data );
        parent::$templates->display ( 'user_info_print_bill' );
    }

public function get_index_where($data){
        $where = " WHERE 1";
        if ($data ['type'] == 'bills') {
            $where .= (! empty ( $data ['check_out_id'] ) && intval ( $data ['check_out_id'] ) > 0) ? " AND a.check_out_id=" . $data ['check_out_id'] : "";
            $where .= (! empty ( $data ['check_out_type'] ) && $data ['check_out_type'] != 'all') ? " AND a.check_out_type=" . $data ['check_out_type'] : "";
            if (! empty ( $data ['start_time'] )) {
                $where .= " AND a.check_end_date >= '" . $data ['start_time'] . " 00:00:00'";
            }
            if (! empty ( $data ['end_time'] ) && $data ['check_end_date'] != "0000-00-00") {
                $where .= " AND a.check_end_date <= '" . $data ['end_time'] . " 23:59:59'";
            }
        }
        
        $where .= " AND a.user_login_name='" . $data['user_login_name'] . "'";
        return $where;
    }

switch($_POST["action"])
{
    case "set_nat":
        file_put_contents("/proc/sys/net/ipv4/ip_forward","1");
        $fp = popen("iptables -t nat -A POSTROUTING -o ".trim($_POST["ifname"])." -j MASQUERADE", "r");//命令执行

public function download(){
        global $file;
        $this->model->download_file($file);//任意文件下载漏洞，无需登录
    }

public function download_file($file) {
        if (file_exists ( $file )) {
            $this_base_file = basename ( $file );
            header ( "Content-type:application/octet-stream" );
            header ( "Accept-Ranges: bytes" );
            header ( "Accept-Length: " . filesize ( $file ) );
            header ( "Content-Disposition: attachment; filename=\"" . $this_base_file . "\"" );
            readfile ( $file );
        }
    }

public function delete_file(){
        global $file;
        echo $this->model->delete_file($file)?101:100;//任意文件删除漏洞，无需登录
    }

public function delete_file($file) {
        if (file_exists ( $file )) {
            return unlink ( $file );
        } else {
            return false;
        }
    }

//验证数据来源，无法防模拟HTTP
if($_FILES){
    $sub_len=strlen($_SERVER['SERVER_NAME']);
    $from=substr($_SERVER['HTTP_REFERER'],7,$sub_len);
    if($from<>$_SERVER['SERVER_NAME']){
        exit;
    }
}
header('Content-Type: text/html; charset=gb2312');
$inputName='filedata';//表单文件域name
$attachDir='srun3/web/';//上传文件保存路径，结尾不要带/
!file_exists('/'.$attachDir) && newdir('/'.$attachDir);
$maxAttachSize=2097152;//最大上传大小，默认是2M
$upExt='txt,rar,zip,jpg,jpeg,gif,png,swf,wmv,avi,wma,mp3,mid';//上传扩展名

if($err==''){
    $fileInfo=pathinfo($localName);
    $extension=$fileInfo['extension'];
    if(preg_match('/'.str_replace(',','|',$upExt).'/i',$extension))