发布作者：心灵
影响版本：天天团购系统
官方网站：http://www.tttuangou.net/
漏洞类型：文件包含
漏洞描述：
首先是本地包含
ajax.php
require_once MOD_PATH.$this->SetEvent($config['default_module']).'.mod.php';
//再看SetEvent
function SetEvent()
{
$modss = array('check'=>1,'getseller'=>1,'member'=>1);
$mod = (isset($_POST['mod']) ? $_POST['mod'] : $_GET['mod']);
if(!isset($modss)) { //程序员思想混乱了.估计老板没发工资
include(INCLUDE_PATH.'error_4.php');
exit;
}
$_POST['mod'] = $_GET['mod'] = $mod;
Return $mod;
}
那么mod.php结尾的那个能用呢？
以下是上传漏洞
看modules\admin\tttuangou.mod.php //后台文件！
class ModuleObject extends MasterObject{
var $city;
function ModuleObject($config){
$this->MasterObject($config); Load::logic('product');
$this->ProductLogic = new ProductLogic();
Load::logic('pay');
$this->PayLogic = new PayLogic();
Load::logic('me');
$this->MeLogic = new MeLogic();
Load::logic('order');
$this->OrderLogic = new OrderLogic();
$this -> config =$config;
$this->ID = (int) ($this->Post['id'] ? $this->Post['id'] : $this->Get['id']);
$this->Execute();
}
//很幸运地以上自定义函数都已经定义了
function Execute(){
switch($this->Code){
case 'varshow':
$this->Varshow();
break;
case 'varedit':
//忽略一堆东西
case 'dositelogo':
$this->doSiteLogoManager();
//再看doSiteLogoManager
function doSiteLogoManager()
{
//这里忽略一些没用的东西
$_FILES['uploads']['name'] = $FILES_O['uploads']['name'][$i];
//继续忽略
$default_type=array('jpg','pic','png','jpeg','bmp','gif'); $imgary=explode('.',$_FILES['uploads']['name']);
if(!in_array(strtolower($imgary[count($imgary)-1]),$default_type)){
$this->Messager('不允许上传的图片格式！');
}
//这里限制了后缀
$full_path = urldecode($this->Get['path']);
$fp_ary = explode('/', $full_path);
$file = $fp_ary[count($fp_ary)-1];
$dir = '';
for ($i=0;$i<count($fp_ary)-1;$i++)
{
if ($fp_ary[$i] != '.')
{
$dir .= $fp_ary[$i].'/';
}
}
$dir = './'.$dir; //o(∩_∩)o 哈哈 悲剧 path自定义名字可以了 直接上传JPG
require_once LIB_PATH . 'upload.han.php';
$upload_handler = new UploadHandler($_FILES, $dir, 'uploads' , true);
同时还发现2处没用的包含漏洞
modules\me.mod.php
function Readdmoney(){
$pay_code = (isset($_POST['pay']) ? $_POST['pay'] : $_GET['pay']); //没过滤
//忽略...
include_once('./modules/'.$pay_code.'.pay.php');
还有index.mod.php
function Repay(){
$pay_code = (isset($_POST['pay']) ? $_POST['pay'] : $_GET['pay']); //一样没过滤
//也忽略...
include_once('./modules/'.$pay_code.'.pay.php');
.pay.php只有3个在线支付文件还没什么用
一切GPC后的东西都是浮云 唯有超长字符截断了
