phpmps后台getshell

  • A+
所属分类:漏洞时代
摘要

admin/flash.php 30-58行
[php]
case ‘insert’:
if(empty($_REQUEST[‘url’]))show(‘链接不能为空’);
if(empty($_FILES[‘file’][‘name’]))
{
show(‘没有上传图片’);
}
else
{
$name = date(‘Ymd’);
for($i = 0;$i < 6;$i++) { $name .= chr(mt_rand(97, 122)); } $name .= '.' . end(explode('.', $_FILES['file']['name'])); $to = PHPMPS_ROOT . 'data/flashimage/' . $name;

admin/flash.php 30-58行
[php]
case 'insert':
if(empty($_REQUEST['url']))show('链接不能为空');
if(empty($_FILES['file']['name']))
{
show('没有上传图片');
}
else
{
$name = date('Ymd');
for($i = 0;$i < 6;$i++) {
$name .= chr(mt_rand(97, 122));
}
$name .= '.' . end(explode('.', $_FILES['file']['name']));
$to = PHPMPS_ROOT . 'data/flashimage/' . $name;

if (move_uploaded_file($_FILES['file']['tmp_name'], $to)){
$image = "data/flashimage/" . $name;
}
}
$url = trim($_REQUEST['url']);
$flaorder = intval($_REQUEST['order']);
$sql = "INSERT INTO {$table}flash (image,url,flaorder) VALUES ('$image','$url','$flaorder');";
$res = $db->query($sql);
$res ? $msg = "添加成功" : $msg = "添加失败";
clear_caches('phpcache', 'flash');

admin_log("添加flash $name 成功");
show($msg, 'flash.php?act=add');
break;[/php]
只是检测是否有上传对于上传的什么没作过滤,直接的getshell
phpmps后台getshell

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: