WooYun.org

if (!empty($_GET['mod'])) {
	$strModuleID = strval($_GET['mod']);  //此处未过滤
	include_once('../'.$strModuleID.'/config/var.inc.php'); //包含需截断
	$objWebInit->setDBG($arrGPdoDB);
	$objWebInit->db();
	$arrLink[] = 'mod=' . $strModuleID;
}else{
	include_once('include/title.php');
	include_once('include/head.php');
	$myText = new HAW_text($arrGWeb['name'].'欢迎您!');
	$objHaw->add_text($myText);
	include_once('include/foot.php');
	exit;
}