Php168 v6.01 global variable coverage

By: xhming

The company. php file under the member directory!

<? Php
Require (dirname (_ FILE _). "/". "global. php ");
@ Include (dirname (_ FILE _). "/../". "php168/all_area.php ");
If ($ job = edit ){
If (! $ Lfjid ){
Showerr ("You have not logged on ");
}
$ CpDB = $ db-> get_one ("SELECT * FROM '{$ pre} memberdata_1' WHERE uid = $ lfjuid ");
If ($ step = 2 ){
Foreach ($ _ post as $ key => $ value ){
$ _ POST [$ key] = filtrate ($ value );
}
@ Extract ($ _ POST); <------------------------------------------- the problem!
If (! $ Cpname) {showerr ("enterprise name cannot be blank ");}

.......................

If (! $ CpDB ){
$ Db-> query ("insert into '{$ pre} memberdata_1' ('uid '.......................

} Else {
$ Db-> query ("UPDATE {$ pre} memberdata_1 SET cpname = .............

We can overwrite the table prefix. We cannot use single quotation marks. Otherwise, we can escalate the permission and use shell!

It would be easy to get shell in the background!