Analysis of Articles Condo 5.5 datalistcp.class.php contains
: St0p
Reproduced, please indicate the source http://www.st0p.org
Long ago to see the hole that was issued, has been thought to write analysis with stay UBUNTU install something. . The old forget. . .
Sometimes friends and I teach him to find the hole. . . This is like is working so hard, and luck play a large part. . . So I try to help analyze the process issued Come, but also to facilitate my own learning.
Specific EXP, see: http://www.st0p.org/blog/archives/dedecms-5-5-datalistcp-class-php-contains-exp.html
Before it, the Articles Condo will go wrong SQL written mysql_error_trace.php later Daniel burst. Changed its name to mysql_error_trace.inc. . .
I did not expect this time to be included. . . Seems to record SQL information is valid and not a good thing. . .
The principle of the EXP, by constructing a special request to the plus, / digg_ajax.php to write our statement to mysql_error_trace.inc, of course, to meet this step is written to, there are many mysql_error_trace.inc file. . But want to run him is impossible. . Then the reported hole is the good luck to encounter. .
Key code exists in the
/ Include / datalistcp.class.php
A 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | ... ( isset ( $needCode ) ? $needCode : $cfg_soft_lang ) ; $ Codefile = (isset ($ needCode)? $ NeedCode: $ cfg_soft_lang); / / $ NeedCode isset function checks whether the configuration, such as configured, the result is $ needCode, otherwise the result is $ cfg_soft_lang / / When we forged aa /.. /.. /.. / Data / mysql_error_trace file_exists ( DEDEINC . '/code/datalist.' . $codefile . '.inc' ) ) if (file_exists (DEDEINC. '/ code / datalist.'. $ codefile. '. inc')) { DEDEINC . '/code/datalist.' . $codefile . '.inc' ) ; require_once (DEDEINC. '/ code / datalist.'. $ codefile. '. inc'); / / Suffix. Inc } / / Check the file exists, there is included. We .. / successful jump to the data directory, including that we have just constructed over mysql_error_trace.inc / / Run successfully statement we mysql_error_trace.inc constructed. . . ... |
Depressed, and previous to write the analysis of the official not to fill it. . Just go to the official looked through the regular patched
A 2 3 4 5 6 7 8 9 10 11 | ( isset ( $needCode ) ? $needCode : $cfg_soft_lang ) ; $ Codefile = (isset ($ needCode)? $ NeedCode: $ cfg_soft_lang); preg_replace ( "/[\w-]/" , '' , $codefile ) ; $ Codefile = preg_replace ("/ [\ w-] /",'', $ codefile); / / Regular filtered. . . file_exists ( DEDEINC . '/code/datalist.' . $codefile . '.inc' ) ) if (file_exists (DEDEINC. '/ code / datalist.'. $ codefile. '. inc')) { DEDEINC . '/code/datalist.' . $codefile . '.inc' ) ; require_once (DEDEINC. '/ code / datalist.'. $ codefile. '. inc'); } |
105 Trackback (s)
You must be logged in to post a comment.