aacms最新注入一处

aacms最新注入一处

作者：mOon 博客：www.moonsec.com 扣扣 40497992

  class_core.php 全局处理 function _init_input() {   global $_G;      if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) {    system_error('request_tainting');   }      if(!MAGIC_QUOTES_GPC) {    $_GET = daddslashes($_GET);    $_POST = daddslashes($_POST);    $_COOKIE = daddslashes($_COOKIE);    $_FILES = daddslashes($_FILES);   }   

block.article.php

<?php  /*  BLOCK标签文章处理 */  if(!defined('IN_AACMS')) {  exit('Access Denied'); }   include_once libfile('function/article');  function block_article($paramarr) {    $sql = $theblockarr = array();     $perpage = $paramarr['perpage'] ? max(intval($paramarr['perpage']), 1) : 20;   $page = $_GET['page'] ? max(intval($_GET['page']), 1) : 1;   $start = max($count - $page * $perpage, 0);      $wherearr = array();     if($paramarr['aid']) {    $wherearr[] = 'aid IN ('.$paramarr['aid'].')';  }  else {   $catid = $paramarr['catid'] ? $paramarr['catid'] : ($_GET['catid'] ? $_GET['catid'] : '0');   if($catid) {    $wherearr[] = 'catid IN ('.$catid.')';   }  }    if($wherearr) {   $sql['where'] = implode(' AND ', $wherearr);  } else {   $sql['where'] = ' 1 ';  }    $count = DB::getOne("SELECT COUNT(*) FROM ".DB::table('article_index').' WHERE '.$sql['where']);  $article_list = article_index($sql['where']." LIMIT $start,$perpage", $ordersql);    $multipage = multi($count, $perpage, $page, $_SERVER['SCRIPT_NAME']);  $article_list['multipage'] = $multipage;  return $article_list; }  ?>

$_GET['catid'] 获取变量 带入in   动态加载函数 function_core.php 
//模块 function block($thekey, $param) {    global $_G, $_BLOCK;     $_BLOCK[$thekey] = array();  $havethekey = false;  $needcache = 0; var_dump($thekey);  //缓存key   $cachekey = dmd5($thekey.$param);  $paramarr = parseparameter($param, 0);   if(!empty($paramarr['cachetime'])) {   if($paramarr['perpage'] && $_GET['page']) {    //分页    $cachekey = dmd5($thekey.$param.$_GET['page']);   }   $cacheupdatetime = $paramarr['cachetime'];  } else {   $cacheupdatetime = 0;   $needcache = 3;//DO NOT CACHE  }   if($cacheupdatetime) {   //获取缓存   getcache($cachekey);    if(!isset($_BLOCK[$cachekey])) {    $needcache = 1;//没有缓存   } else {    //创建下次更新时间    if(!empty($_BLOCK[$cachekey]['filemtime'])) $_BLOCK[$cachekey]['updatetime'] = $_BLOCK[$cachekey]['filemtime'] + $cacheupdatetime;    if($_BLOCK[$cachekey]['updatetime'] < $_G['timestamp']) {     $needcache = 2;//需要更新    }   }  }
 漏洞证明：
   

   AD（代码审计师、漏洞挖掘师）四月份结束 ，需要加入的请速度联系囖。木木达 
    
   没加群的同学 加加群 群里有妹子  
   点击链接加入群【暗月信息安全交流群】：http://jq.qq.com/?_wv=1027&k=YmWBiK