V8.0 vulnerability and repair

// Upload \ I \ index. php

<? Php
// Omitted
$ Controller =! Empty ($ _ GET ['C'])? $ _ GET ['C']: 'index ';
$ Action =! Empty ($ _ GET ['a'])? $ _ GET ['a']: 'index ';
 
//
 
// Automatically log on to the cookie and determine the uri
If (isset ($ _ COOKIE ['cuser']) & $ _ COOKIE ['cuser'] ['userid']! = 0 ){
$ UserID = GetCUserID ();
$ Domain = GetCUserDomain ();
$ SQL = 'select * FROM members WHERE userID = "'. $ userID .'"';
$ ArrRow = $ objC-> GetRow ($ SQL );
//
}
}
} Else if ($ domain = 'C' | $ domain = 'A' | $ domain = ''){
$ Domain = GetCUserDomain ();
$ Params ['controller'] = $ controller;
$ Params ['action'] = $ action;
$ Params ['domain '] = $ domain;
}
 
//
 
$ FilePath = CONTROLLER_PATH. $ classname. '. php ';
//

 

Usage: http://www.bkjia.com/I/index. php? C =/../robots.txt % 00

You can consider including logs. (Chicken ribs)

Background shell:

<? Php
// Upload \ admin \ themedetail. php
//
If (isset ($ _ POST ['content']) {
 
$ Content = stripslashes (htmlspecialchars_decode ($ _ POST ['content']);

$ Theme = $ _ POST ['Theme '];
$ File = $ _ POST ['file'];
If (! Array_key_exists ($ file, $ files) die ('this template file does not exist ');
If (! Preg_match ("/^ \ w + \/$/", $ theme) die ('template path exception ');
$ Path = TEMPLATES. 'Theme/'. $ theme. $ file;
If (is_file ($ path )){
$ Rs = file_put_contents ($ path, $ content );
If ($ rs)
FlushHTML ('template modified successfully! <Br/> ');
// Www.2cto.com
 
}
//
} Else {
If ($ _ GET ['Theme ']) {
$ Theme = $ _ GET ['Theme '];
} Else {
$ Theme = THEME_PATH;
}

$ Path = TEMPLATES. 'Theme/'. $ theme. $ _ GET ['file'];
If (is_file ($ path )){
$ Content = htmlspecialchars (getContent ($ path ));
$ ObjS-> assign ("content", $ content );
$ ObjS-> assign ("theme", $ theme );
$ ObjS-> assign ("file", $ _ GET ['file']);
$ ObjS-> display ("admin/themedetail. tpl ");
}
//
 
}
}
 
 

// Usage: directly edit and write a sentence. Key injection.

Http://t.qq.com/MakeBug

Repair: targeted repair