Error in dog customization and cropping logic, leading to csrf pants Removal

Error in dog customization and cropping logic, leading to csrf pants Removal

The system interaction degree of csrf trousers caused by a custom cropping logic error of the dog is relatively large.

View the Code directly:
 

db.mod.php:(576-620)：$f = str_replace(array('/', '\\', '.'), '', $filename);$f = dir_safe($f);$backupdir = 'db/' . $f;$backupfilename = './data/backup/'.$backupdir.'/'.$f;if (!is_dir(($d = dirname($backupfilename)))) {jio()->MakeDir($d);}if($usezip) {require_once ROOT_PATH . 'include/func/zip.func.php';}if($method == 'multivol') {$sqldump = '';$tableid = intval(get_param('tableid'));$startfrom = intval(get_param('startfrom'));$complete = TRUE;for(; $complete && $tableid < count($tables) && strlen($sqldump) + 500 < $sizelimit * 1000; $tableid++) {$sqldump .= $this->_sql_dump_table($tables[$tableid], $startfrom, strlen($sqldump));if($complete) {$startfrom = 0;}}$dumpfile = $backupfilename."-%s".'.sql';!$complete && $tableid--;if(trim($sqldump)) {$sqldump = "$idstring"."# <?php exit(); ?>\n"."# JishiGou Multi-Volume Data Dump Vol.$volume\n"."# Version: JishiGou ".SYS_VERSION."\n"."# Time: $time\n"."# Type: $type\n"."# Table Prefix: $tablepre\n"."#\n"."# JishiGou Home: http:\/\/www.jishigou.net\n"."# Please visit our website for newest infomation about JishiGou\n"."# --------------------------------------------------------\n\n\n"."$setnames".$sqldump;$dumpfilename = sprintf($dumpfile, $volume);

We can see that the database name without the final backup comes from two places. Let's refine it:
 

$f = str_replace(array('/', '\\', '.'), '', $filename);$f = dir_safe($f);$backupdir = 'db/' . $f;$backupfilename = './data/backup/'.$backupdir.'/'.$f;$dumpfile = $backupfilename."-%s".'.sql';$dumpfilename = sprintf($dumpfile, $volume);

We can see that none of these parameters are completely controllable from the url. We send the url:

Http: // 192.168.10.70/archiver-jishigou.4.7.4.20140922.utf8/admin. php? Mod = db & code = doexport & type = all_tables & saveto = server & filename = 201409261043_xxxx & method = multivol & sizelimit = 2048 & volume = 2 & tableid = 1 & startfrom = 0 & extendins = 1 & sqlcharset = & sqlcompat = & exportsubmit = yes & usehex = 1 & usezip = 0



Filename and volume control the name of the backup file.

Please visit
 

 

This is a get request, and without csrf, you can share a link on your website to the Administrator. You can also embed images in Weibo.
 

Solution:

Filter