WooYun.org

http://www.3m4.net/admin/login.php
http://yulin.0912007.com/admin/login.php
http://www.cwen.org/114//admin/login.php
http://www.puerquan.com/daohang//admin/login.php
http://www.dm566.com//admin/login.php
http://95880.net//admin/login.php
http://hao.56lem.com/admin/login.php
http://daoh.22web.org/admin/login.php
http://www.114diy.cn/admin/login.php
http://56114.com.cn/admin/login.php

<?php
set_time_limit ( 0 );
define ( 'ROOT' , str_replace("\\","/",dirname(dirname($_SERVER['SCRIPT_FILENAME'])).'/' ));
define ( 'PANEL_ROOT' , str_replace("\\","/",dirname(__FILE__)).'/' );
include_once(ROOT.'include/debug.php');
require_once(ROOT.'include/smarty_inc.php');
require_once(ROOT.'include/mysql_inc.php');
require_once(ROOT.'include/config_inc.php');
$templates->assign("version",$version);
$templates->assign("full_version",$full_version);
$templates->assign("build_version",$build_version);
$templates->assign("public_time",$public_time);
$type = _T(@$_GET['type']);
if(empty($type))
{
	$templates->display( PANEL_ROOT.'templates/login.tpl' );
}
elseif($type=='login')
{
	$db = new db_mysql( $dbhost, $dbuser, $dbpwd, $dbname);
	$username = _T(@$_POST['username']);
	$password = _T(@$_POST['password']);
	$user = $db->select("SELECT * FROM `{$dbprefix}_admin` WHERE `Name` = '{$username}'");

function _T($str)     
{     
	if (!get_magic_quotes_gpc())
	{     
		$str = addslashes($str);
	}     
	return $str;
}
?>

<?php
session_start( );
set_time_limit ( 0 );
define ( 'ROOT' , str_replace("\\","/",dirname(dirname($_SERVER['SCRIPT_FILENAME'])).'/' ));
include_once(ROOT.'include/debug.php');
require_once(ROOT.'/include/config_inc.php');
require_once(ROOT.'/include/smarty_inc.php');
require_once(ROOT.'/include/mysql_inc.php');
$db = new db_mysql( $dbhost, $dbuser, $dbpwd, $dbname);
$type = _T(@$_GET['type']);
if(empty($type))
{
  $templates->assign("sites", $sites);
  $templates->display(ROOT."common/linkin.tpl");
}
else
{
  $Name = _T($_POST['Name']);
  $Link = _T($_POST['Link']);
  $Describe = _T($_POST['Describe']);
  if (empty($Name)||empty($Link)||empty($Describe))
  {
	echo "<script language=\"javascript\" type=\"text/javascript\">\n";
	echo "<!--\n";
	echo "alert (\"请将表单填写完整\");\n";
	echo "window.history.go(-1);\n";
	echo "-->\n";
	echo "</script>\n";
	exit();
  }
  $ip = getenv("REMOTE_ADDR");
  $db->query("INSERT INTO `".$dbprefix."_linkin` VALUES ('0' , '{$Name}', '{$Link}', NOW( ) , '{$ip}', '{$Describe}');");
  echo "<script language=\"javascript\" type=\"text/javascript\">\n";
  echo "<!--\n";
  echo "alert (\"申请成功，我们会尽快处理。\");\n";
  echo "window.history.go(-1);\n";
  echo "-->\n";
  echo "</script>\n";
}
?>