WooYun.org

漏洞文件：/protected/apps/member/controller/photocontroller.php
public function add()
{
if(!$this->isPost()){
$sortlist=model('sort')->select('','id,name,deep,tplist,path,norder,type');
if(empty($sortlist)) $this->error('请先添加图集栏目~',url('sort/photoadd'));
$sortlist=re_sort($sortlist);
foreach($sortlist as $vo){
if($this->checkConPower($vo['id'])){
$ct=explode(',',$vo['tplist']);
$tpco[$vo['path'].','.$vo['id']]=$ct[1];
$space = str_repeat('├┈┈┈', $vo['deep']-1);
$disable=($this->sorttype==$vo['type'])?'':'disabled="disabled" style="background-color:#F0F0F0"';
$option.= '<option '.$disable.' value="'.$vo['path'].','.$vo['id'].'">'.$space.$vo ['name'].'</option>';
}
}
$this->option=$option;
$this->tpc=json_encode($tpco);//默认模板处理
//$places=model('place')->select('','','norder DESC');//定位
// $this->places=$places;
$this->sortlist=$sortlist;
$this->type=$this->sorttype;
$this->twidth=config('thumbMaxwidth');
$this->theight=config('thumbMaxheight');
$this->picpath=__ROOT__.'/upload/photos/';
$this->display();
}else{
if(empty($_POST['sort'])||empty($_POST['title'])||empty($_POST['tpcontent']))
$this->error('请填写完整的信息~');
$data=array();
//扩展模型开始
if (!empty($_POST['tableid'])) {
$tableid = intval($_POST['tableid']);
$info = model('extend')->find("id='{$tableid}'",'tableinfo'); //查询表
$list = model('extend')->select("pid='{$tableid}'",'','id desc'); //查询表中字段
foreach ($list as $vo) {
if (!empty($vo['tableinfo'])) {
if(is_array($_POST['ext_'.$vo['tableinfo']]))
$fvalue=implode(',',$_POST['ext_'.$vo['tableinfo']]);
else
$fvalue=in($_POST['ext_'.$vo['tableinfo']]);
$ex_data[$vo['tableinfo']] = empty($fvalue)?$vo['defvalue']:$fvalue; //循环post字段
}
}
$extfield=model('extend')->Extin($info['tableinfo'],$ex_data);
$data['extfield']=$extfield;
}
//扩展模型结束
$data['account']=$this->mesprefix.$this->auth['account'];
$data['sort']=$_POST['sort'];
$data['exsort']=empty($_POST['exsort'])?'':implode(',',$_POST['exsort']);
$data['title']=in($_POST['title']);
$data['keywords']=in($_POST['keywords']);
$data['picture']=$_POST['picture'];
$data['description']=in($_POST['description']);
$data['content']=in($_POST['content']);
$data['method']='photo/content';
$data['tpcontent']=in($_POST['tpcontent']);
$data['ispass']=0;
$data['recmd']=0;
$data['hits']=0;
$data['norder']=0;
$data['addtime']=time();
// if (empty($data['description'])) {
// $data['description']=in(substr(deletehtml($_POST['content']), 0, 250)); //自动提取描述
// }
// if(empty($data['keywords'])){
// $data['keywords']= $this->getkeyword($data['title'].$data['description']); //自动获取中文关键词
// if(empty($data['keywords'])) $data['keywords']=str_replace(' ',',',$data['description']);//非中文
// }
// if($_POST['iftag']) {
// $iftag = $this->crtags($data['keywords']);
// if(!$iftag) $this->alert('标签生成失败~');
// }
if(!empty($_POST['photolist']))
$data['photolist']=implode(',',$_POST['photolist']);
if(!empty($_POST['conlist']))
$data['conlist']=implode(',',in($_POST['conlist']));
if(model('photo')->insert($data)){
$this->success('图集添加成功~',url('photo/index'));
}
else $this->error('图集添加失败');
}
}
这里有一个添加图集的方法看到：$data['photolist']=implode(',',$_POST['photolist']);
这里直接获取图片列表，然后插库。
在同一个文件里还有一处删除的方法：
public function del()
{
$path=$this->uploadpath;
if(!$this->isPost()){
$id=intval($_GET['id']);
if(empty($id)) echo '参数错误~';
else{
$photos=model('photo')->find("id='$id'",'photolist,sort,extfield,account');
if($photos['account']!=$this->mesprefix.$this->auth['account']){
echo '请不要越权编辑其他用户信息~';
return;
}
$sortid=substr($photos['sort'],-6,6);
$exid=model('sort')->find("id='{$sortid}'",'extendid');
if($exid['extendid']!=0){
$table=model('extend')->find("id='{$exid['extendid']}'",'tableinfo');
if(!empty($table['tableinfo'])){
if(!($this->model->table($table['tableinfo'])->where("id='{$photos['extfield']}'")->delete())){//删除拓展表中关联信息
echo '删除拓展信息失败~';
return;
}
}
}
if(!empty($photos['photolist'])){
$phoarr=explode(',',$photos['photolist']);
foreach ($phoarr as $vo){
if(file_exists($path.$vo))
@unlink($path.$vo);
if(file_exists($path.'thumb_'.$vo))
@unlink($path.'thumb_'.$vo);
}
}
if(model('photo')->delete("id='$id'"))
echo 1;
else echo '删除失败~';
看到这里有$path=$this->uploadpath;
在类的初始化有个$this->uploadpath=ROOT_PATH.'upload/photos/';
也就是说install.lock文件的路径就会是：../../protected/apps/install/install.lock
要先跳出上传路径然后才能找到install.lock文件的位置：
我们回到这个删除方法：$photos=model('photo')->find("id='$id'",'photolist,sort,extfield,account');
这里把我们刚刚输入的photolist提取了出来。
if(!empty($photos['photolist'])){
$phoarr=explode(',',$photos['photolist']);
foreach ($phoarr as $vo){
if(file_exists($path.$vo))
@unlink($path.$vo);
if(file_exists($path.'thumb_'.$vo))
判断了photolist存在就遍历数组进行删除。
也就是说我们之前插入的photolist被提取了出来遍历进行删除。也就达到了任意文件删除的条件。