ECShop网店系统<=V2.6.2 后台拿webshell

if ($_REQUEST[act] == sync)
{
$size = 100;
......
$tasks = array();
if ($task_del > 0)
{
$tasks[] = array(task_name=>sprintf($_LANG[task_del], $task_del),task_status=> . $_LANG[task_uncomplete] . );
$sql = "SELECT user_name FROM " . $ecs->table(users) . " WHERE flag = 2";
$del_list = $db->getCol($sql);//$del_list未初始化
}
if ($task_rename > 0)
{
$tasks[] = array(task_name=>sprintf($_LANG[task_rename], $task_rename),task_status=> . $_LANG[task_uncomplete] . );
$sql = "SELECT user_name, alias FROM " . $ecs->table(users) . " WHERE flag = 3";
$rename_list = $db->getAll($sql);//$rename_list未初始化
}
if ($task_ignore >0)
{
$sql = "SELECT user_name FROM " . $ecs->table(users) . " WHERE flag = 4";
$ignore_list = $db->getCol($sql);//$ignore_list未初始化
}
......
/* 保存修改日志 */
$fp = @fopen(ROOT_PATH . DATA_DIR . /integrate_ . $_SESSION[code] . _log.php, wb);
$log = ;
if (isset($del_list))
{
$log .= $del_list= . var_export($del_list,true) . ;;
}
if (isset($rename_list))
{
$log .= $rename_list= . var_export($rename_list, true) . ;;
}
if (isset($ignore_list))
{
$log .= $ignore_list= . var_export($ignore_list, true) . ;;
}
//未做过滤，直接写log
fwrite($fp, $log);
fclose($fp);
$smarty->assign(tasks, $tasks);
$smarty->assign(ur_here,$_LANG[user_sync]);
$smarty->assign(size, $size);
$smarty->display(integrates_sync.htm);
}