WooYun.org

http://test.nitc.cc/office/privilege.php?action=login

<?php
/*********************/
/*                   */
/*  Version : 5.1.0  */
/*  Author  : RM     */
/*  Comment : 071223 */
/*                   */
/*********************/
function exe_php_page( $php_file, $assign )
{
                                $template = ROOT_PATH."themes/".$GLOBALS['_CFG']['template']."/".$php_file;
                                if ( file_exists( $template ) )
                                {
                                                                extract( load_xml_config( $GLOBALS['_CFG']['template'] ) );
                                                                extract( $assign );
                                                                extract( initpublic( $language_cur, $template ) );
                                                                require( $template );
                                }
}
define( "IN_LOCK", TRUE );
define( "ROOTPATH", str_replace( "\\", "/", dirname( __FILE__ )."/" ) );
if ( !file_exists( ROOTPATH."includes/install.lock" ) )
{
                                header( "location:install/" );
                                exit( );
}
$is_dynamic = 1;
require( "includes/init.php" );
$is_protect = isset( $_REQUEST['is_protect'] ) ? $_REQUEST['is_protect'] : 0; //这参数很关键 为1 绕过下面
if ( $GLOBALS['_CFG']['pseudo_static'] != 1 && $is_protect == 0 )
{
                                header( "location:index.html" );
                                exit( );
}
....
else if ( $_GET['action'] == "content" )
{
                                $rid = $_GET['rid']; //没处理
                                if ( $url_separate == "_" )
                                {
                                                                $channel_flag = str_replace( "_", "-", $channel_flag );
                                }
                                $content = $db->getAll( "select channel_content_id,channel_category_id,date_added,is_color,color,is_underline,is_bold,is_italic,filename,small_image,original_image,sort_order from ".$site->table( "channel_content" ).( " where channel_content_id=".$rid ) ); //没用单引号包起来存在注入
                                $sort_order = $content[0]['sort_order'];
                                $date_added = $content[0]['date_added'];
                                $news_id11 = $content[0]['channel_category_id'];
                                $pre_content = $db->getRow( "select content.channel_content_id,content_desc.name from ".$site->table( "channel_content" )." as content left join ".$site->table( "channel_content_desc" )." as content_desc on content.channel_content_id=content_desc.channel_content_id where content.channel_category_id=".$news_id11." and content_desc.language_id=".$language['language_id'].( " and (content.sort_order > ".$sort_order." or (content.date_added > '{$date_added}' and content.sort_order = '{$sort_order}'))  order by content.sort_order asc, content.date_added asc LIMIT 0,1" ) );
                                if ( $pre_content )
                                {
                                                                $pre_content_url = get_channel_content_url( "url", $language['directory'], $language['default_value'], $pre_content['name'], $pre_content['channel_content_id'], $channel_flag );
                                                                $pre_link = "<a href='".$pre_content_url."'>".$_LANG['content_previous']."</a>";
                                }
                                $next_content = $db->getRow( "select content.channel_content_id,content_desc.name from ".$site->table( "channel_content" )." as content left join ".$site->table( "channel_content_desc" )." as content_desc on content.channel_content_id=content_desc.channel_content_id where content.channel_category_id=".$news_id11." and content_desc.language_id=".$language['language_id'].( " and (content.sort_order < ".$sort_order." or (content.date_added < '{$date_added}' and content.sort_order = '{$sort_order}'))  order by content.sort_order desc, content.date_added desc LIMIT 0,1" ) );
                                if ( $next_content )
                                {
                                                                $next_content_url = get_channel_content_url( "url", $language['directory'], $language['default_value'], $next_content['name'], $next_content['channel_content_id'], $channel_flag );
                                                                $next_link = "<a href='".$next_content_url."'>".$_LANG['content_next']."</a>";
                                }
                                $related_content = $db->getAll( "select channel_content_id,channel_category_id,date_added,is_color,color,is_underline,is_bold,is_italic,filename,small_image,original_image from ".$site->table( "channel_content" )." where channel_category_id=".$news_id11." order by sort_order desc, date_added desc" );
                                $cnt = 0;
                                $id_arr = array( );
                                $max_id = 0;
                                $relate_arr = array( );
                                foreach ( $related_content as $key => $value )
                                {
                                                                if ( $value['channel_category_id'] == $news_id11 )
                                                                {
                                                                                                $content_desc = $db->getRow( "select * from ".$site->table( "channel_content_desc" )." where channel_content_id=".$value['channel_content_id']." and language_id=".$language['language_id'] );
                                                                                                if ( $content_desc )
                                                                                                {
                                                                                                                                $content_url = get_channel_content_url( "url", $language['directory'], $language['default_value'], $content_desc['name'], $value['channel_content_id'], $channel_flag );
                                                                                                                                $relate_arr[] = array(
                                                                                                                                                                "content_url" => $content_url,
                                                                                                                                                                "name" => $content_desc['name'],
                                                                                                                                                                "channel_content_id" => $value['channel_content_id']
                                                                                                                                );
                                                                                                                                ++$cnt;
                                                                                                                                if ( 7 <= $cnt )
                                                                                                                                {
                                                                                                                                                                break;
                                                                                                                                                                break;
                                                                                                                                }
                                                                                                }
                                                                }
                                                                else
                                                                {
                                                                                                $id_arr[] = $value['channel_content_id'];
                                                                                                if ( $max_id == 0 )
                                                                                                {
                                                                                                                                $max_id = $value['channel_content_id'] + 1;
                                                                                                }
                                                                }
                                }
....