WooYun.org

public function index() {                parent::tologin();        $appname=trim($this->_get('appname'));                $action=$this->_get('action');//直接调用方法                $out=urldecode($_GET['out']); //未过滤，直接提交。                //是否开启应用                $app=M('Plugins')->where("directory='$appname' AND available=1")->find();                $this->assign('app',$app);                if (!$app) {                        $this->display('apperror');                        exit;                }                //是否添加                if ($app['type']=='app') {                        $myapp=M('Myapps')->where("user_id='".$this->my['user_id']."' AND appid='$app[id]'")->find();                        if (!$myapp) {                                $this->display('addapp');                                exit;                        }                        if (time()-$myapp['lasttime']>600) {                                M('Myapps')->where("id='$myapp[id]'")->setField('lasttime',time());                        }                }                //获取内容                if (@file_exists(ET_ROOT .'/Apps/'.$appname.'/index.class.php')) {                        include_once(ET_ROOT .'/Apps/'.$appname.'/index.class.php');            if (class_exists($appname)) {                                if (!@file_exists(ET_ROOT.'/Apps/'.$appname.'/'.$out)) {                    $out='';                }                if (!$out) {                    $plugin=new $appname($this);                    if ($action) {                        echo $plugin->$action();                        exit;                    } else {                        if (method_exists($appname,index)) {                            $content=$plugin->index();                        }                    }                } else {                    include_once(ET_ROOT .'/Apps/'.$appname.'/'.$out);//直接调用$out                    exit;                }            }        }                if (!$content) {            $this->display('apperror');                        exit;        }                                $this->assign('subname',$app['name']);                $this->assign('content',$content);        $this->display();    }

文件出现在upload\Home\Lib\Model\AppAction.class.php