dedecms v5.1 漏洞

\include\inc_bookfunctions.php

---------------------------------------------------

……

function WriteBookText($cid,$body)

{<span id="more-1944"></span>

global $cfg_cmspath,$cfg_basedir;

$ipath = $cfg_cmspath."/data/textdata";

$tpath = ceil($cid/5000);

if(!is_dir($cfg_basedir.$ipath)) MkdirAll($cfg_basedir.$ipath,$GLOBALS['cfg_dir_purview']);

if(!is_dir($cfg_basedir.$ipath.'/'.$tpath)) MkdirAll($cfg_basedir.$ipath.'/'.$tpath,$GLOBALS['cfg_dir_purview']);

$bookfile = $cfg_basedir.$ipath."/{$tpath}/bk{$cid}.php";

$body = "&lt;"."?php\r\n".$body."\r\n?"."&gt;";

@$fp = fopen($bookfile,'w');

@flock($fp);

@fwrite($fp,$body);

@fclose($fp);

<div id="qhide_185676" class="qt" style="display: block;">}

</div>

……

责任编辑：火韦推荐给好友 到论坛交流 加入收藏 打印本页 关闭窗口