JXCMS 0day 生成缓存文件时变量未处理导致直接写 WebShell

Includetags.func.php：

unction tag_list($type = 'new', $rows = 8, $catid = 0, $keywords = '', $page = 0, $outid = 0, $hotday = 0, $catrule = '') {
        if ($type == 'like' && empty($keywords))return array();
        $cachename = "list_{$type}_{$rows}";
        $cachedir = $catid ? $catid : 'base';
        $page && $cachename .= "_{$page}";
        $outid && $cachename .= "_{$outid}";
        $hotday && $cachename .= "_{$hotday}";
        $catrule && $cachename .= '_' . str_replace(':', '', $catrule);
        $data = $type == 'like' || !CACHE ? false : cache_read($cachename, $cachedir, CACHE_TAGS_TTL); //一些内容不用缓存，避免缓存文件数过多
        if ($data === false) {
                $ename = get_model($catid, 'ename');
                $data = $GLOBALS['tags_' . $ename] -> tag_list($type, $rows, $catid, 0, $keywords, $page, $outid, $hotday, $catrule); // 传入 tag_list() 返回结果
                $type != 'like' && CACHE && cache_write($cachename, $data, $cachedir); // $data 控制输出内容, $cachename 做了$data 的文件名称.
        }
        return $data;
}

articlearticle.class.php：

function tag_list($type = 'new', $rows = 8, $catid = 0, $onlypic = 0, $keywords = '', $page = 0, $outid = 0, $hotday = 0, $catrule = '') {
                $res = array();
                $data = $this -> get_data($type, $catid, $keywords, $rows, $onlypic, $page, $outid, $hotday, $catrule);
                $i = 1;
                while ($tmp = $this -> db -> fetch_array($data)) { // 取出的结果 遍历
                        $contenturl = 'article.php?id=' . $tmp['id'];
                        $categoryurl = 'list.php?catid=' . $tmp['catid'];
                        if ($this -> ishtml) {
                                $htmldir = getcontenthtmldir($tmp['catid']); // 后台设置生成内容页html保存的目录
                                $categoryurl = $this -> cat_s[$tmp['catid']]['dir'] . '/';
                                $contenturl = gethtmlname($contenturl, $tmp['addtime'], $this -> htmlnametype, $this -> htmldirtype, $htmldir);
                        }
                        $tmpcolor = $tmp['color'] ? ' style="color:' . $tmp['color'] . '"' : ''; // !
                        if (empty($tmp['description']) && $GLOBALS['set_cutedeslen']) {
                                $tmp['description'] = tag_description($tmp['content'], $GLOBALS['set_cutedeslen'], 1); //!
                        }
                       
                        if ($tmp['defaultpicurl']) {
                                $imgurl = strstr($tmp['defaultpicurl'], '://') ? $tmp['defaultpicurl'] : $this -> rootdir . $tmp['defaultpicurl'];
                        } else $imgurl = '';
                       
                        $res[$i] = array('catname' => $this -> cat_s[$tmp['catid']]['name'], 'caturl' => $this -> rootdir . $categoryurl, 'url' => $this -> rootdir . $contenturl, 'imgurl' => $imgurl, 'title' => shtmlspecialchars($tmp['title']), 'color' => $tmpcolor, 'time' => $tmp['updatetime'], 'description' => $tmp['description']); // 这里imgurl， title， description ，都是可以控制的。
                        $i++;
                       
                }
                $page && $res = array('list' => $res, 'pages' => $this -> pages);
                return $res;
        }

article/article.class.php function check() 回溯：

function check($info, $uselinkurl, $cutedes) {
                global $set_titlelen, $set_contentlen, $gcat_s, $charset, $set_cutedeslen;
                $charset = strtolower($charset);
                $info['title'] = trim($info['title']);
                if (empty($info['title'])) {
                        $this -> msg = $this -> lang['title_empty'];
                        return false;
                } else {
                        $info['title'] = shtmlspecialchars($info['title']);
                        $len = $charset == 'utf-8' ? utf8_strlen($info['title']) : strlen($info['title']);
                        if ($len $set_titlelen[1]) {
                                $this -> msg = $this -> lang['title_length_error'];
                                return false;
                        }
                }
                if (!defined('JXCMS_ADMIN')) {
                        $info['content'] = fbword(RemoveXSS($info['content'])); //RemoveXss 是一个自定义过滤函数，目前还没办法绕过.
                        $info['title'] = fbword($info['title']);
                        isset($info['description']) && $info['description'] = fbword($info['description']);
                }
                $len = $charset == 'utf-8' ? utf8_strlen($info['content']) : strlen($info['content']);
                if (!$uselinkurl && ($len > $set_contentlen[1] or $len
                        $this -> msg = $this -> lang['content_length_error'];
                        return false;
                }
                $info['catid'] = intval($info['catid']);
                $tmp = &$gcat_s[$info['catid']];
                if ($tmp['model'] == 0 or $tmp['isparent'] == 1) {
                        $this -> msg = $this -> lang['cate_error'];
                        return false;
                }
                if (isset($info['description'])) $info['description'] = strip_tags($info['description']); //strip_tags 函数以为能用evevalal这样来试着绕过，但是定界符用的小于号被删掉了。这样代码规范就不完整了。
                elseif (!empty($info['content']) && $set_cutedeslen && $cutedes) {
                        $tmp = strip_tags($info['content']);
                        $info['description'] = tag_cut($tmp, $set_cutedeslen);
                }

Exp：