Biweb v5.8.5 local vulnerability inclusion and repair

Affected Versions: biweb v5.8.5 (latest official version)

Official Website: www.biweb.cn

Program Description: BIWEB Business Intelligence website system is a large-scale website system based on the enterprise application-level PHP development framework of ArthurXF, it is a fast development, simple and easy-to-use object-oriented enterprise application level developed and designed by Shanghai network affairs Network Information Co., Ltd. after 5 years of continuous practice, summary, and development in a variety of large projects. php mvc website creation system. It is now released open-source by the Shanghai network service company to promote the development of the industry.

Vulnerability page: wap \ detail. php multiple detail. php codes are the same

By: With... wind.

Vulnerability code:

<? Php
Require_once ('config/config. inc. php ');
Require_once ("class/wap. class. php ");

.....

If (! Empty ($ _ GET ['mod']) {// unfiltered mod by: With... wind.

$ StrModuleID = strval ($ _ GET ['mod']);
Include_once ('../'. $ strModuleID. '/config/var. inc. php'); // directly include by: With... wind.
$ ObjWebInit-> setDBG ($ arrGPdoDB );
$ ObjWebInit-> db ();
$ ArrLink [] = 'mod = '. $ strModuleID;
} Else {

..

?>

 

When magic_quotes_gpc = Off

Fixed: enhanced Filtering