WooYun.org

先看过滤函数：
function inject_check($sql)
{ 
	return preg_match("/(select|insert|delete|\.\.\/|\.\/|union|into|load_file|outfile|\'|%27|{|\()/i", $sql);// 进行过滤   
}
function magic()
{
	
	if(!get_magic_quotes_gpc()&&isset($_POST))
	{
		foreach($_POST as $key=>$v)
		{
			if(!is_array($v))
				$_POST[$key]=addslashes($v);
			else
			{
				foreach($v as $skey=>$sv)
				{
					$_POST[$key][$skey]=addslashes($sv);
				}
			}
		}
	}
	
	//===========GET
	if(inject_check(implode('',$_GET)))
	{
		die('Invalid URL !');
	}
	//===========POST
	if(isset($_POST))
	{
		foreach($_POST as $key=>$v)
		{
			if(!is_array($v))
			{
				if(strpos($v,'eval(')or(strpos($v,'$_POST[')))
					die('Invalid POST');
			}
		}
	}
}

在看b2bbuilder.php 文件中的代码：
if(!empty($_GET['m']))
{	
	$_GET['s']=!empty($_GET['s'])?$_GET['s']:'index';
	$s=str_replace('/','',$_GET['s']);
	$m=$_GET['m'];
	if(file_exists($config['webroot'].'/module/'.$m.'/'.$s.'.php'))
	{
		if(file_exists($config['webroot'].'/config/module_'.$m.'_config.php'))
		{
			@include($config['webroot'].'/config/module_'.$m.'_config.php');
			$mcon='module_'.$m.'_config';
			@$config = array_merge($config,$$mcon);
		}
		@include('module/'.$m.'/lang/'.$config['language'].'.php');
		include('module/'.$m.'/'.$s.'.php');
	}
	elseif(file_exists($m.'.html'))
		include($m.'.html');
	else
		header("Location: 404.php");