由于文件get_linkage.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。 相关代码如下： /api/ get_linkage.php <code>case 'ajax_select': $parent_id = $_GET['parent_id'] ? intval($_GET['parent_id']) : 0; $keyid = $_GET['keyid']; ajax_select($parent_id,$keyid); 函数ajax_select在相同文件中有定义 function ajax_select($parentid,$keyid) { $datas = getcache($keyid,'linkage'); $infos = $datas['data']; $json_str = "["; $json = array(); foreach($infos AS $k=>$v) { if($v['parentid'] == $parentid) { $r = array('region_id' => $v['linkageid'], 'region_name' => $v['name']); $json[] = JSON($r); } } $json_str .= implode(',',$json); $json_str .= "]"; echo $json_str; }</code> 变量$keyid未经过滤进入到函数getcache中 Getcache函数在文件/ phpcms/libs/functions/ global.func.php中 <code>function getcache($name, $filepath='', $type='file', $config='') { pc_base::load_sys_class('cache_factory','',0); if($config) { $cacheconfig = pc_base::load_config('cache'); $cache =...
由于文件get_linkage.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。 相关代码如下： /api/ get_linkage.php <code>case 'ajax_select': $parent_id = $_GET['parent_id'] ? intval($_GET['parent_id']) : 0; $keyid = $_GET['keyid']; ajax_select($parent_id,$keyid); 函数ajax_select在相同文件中有定义 function ajax_select($parentid,$keyid) { $datas = getcache($keyid,'linkage'); $infos = $datas['data']; $json_str = "["; $json = array(); foreach($infos AS $k=>$v) { if($v['parentid'] == $parentid) { $r = array('region_id' => $v['linkageid'], 'region_name' => $v['name']); $json[] = JSON($r); } } $json_str .= implode(',',$json); $json_str .= "]"; echo $json_str; }</code> 变量$keyid未经过滤进入到函数getcache中 Getcache函数在文件/ phpcms/libs/functions/ global.func.php中 <code>function getcache($name, $filepath='', $type='file', $config='') { pc_base::load_sys_class('cache_factory','',0); if($config) { $cacheconfig = pc_base::load_config('cache'); $cache = cache_factory::get_instance($cacheconfig)->get_cache($config); } else { $cache = cache_factory::get_instance()->get_cache($type); } return $cache->get($name, '', '', $filepath); } </code> $cache->get()在文件/phpcms/libs/classes/cache_file.class.php <code>public function get($name, $setting = '', $type = 'data', $module = ROUTE_M) { $this->get_setting($setting); if(empty($type)) $type = 'data'; if(empty($module)) $module = ROUTE_M; $filepath = CACHE_PATH.'caches_'.$module.'/caches_'.$type.'/'; $filename = $name.$this->_setting['suf']; if (!file_exists($filepath.$filename)) { return false; } else { if($this->_setting['type'] == 'array') { $data = @require($filepath.$filename);</code> 最终$keyid变量变为$filename的一部分，造成本地文件包含漏洞的产生 由于文件get_linkage.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。 相关代码如下： /api/ get_linkage.php <pre class="prettyprint linenums">case 'ajax_select': $parent_id = $_GET['parent_id'] ? intval($_GET['parent_id']) : 0; $keyid = $_GET['keyid']; ajax_select($parent_id,$keyid); 函数ajax_select在相同文件中有定义 function ajax_select($parentid,$keyid) { $datas = getcache($keyid,'linkage'); $infos = $datas['data']; $json_str = "["; $json = array(); foreach($infos AS $k=>$v) { if($v['parentid'] == $parentid) { $r = array('region_id' => $v['linkageid'], 'region_name' => $v['name']); $json[] = JSON($r); } } $json_str .= implode(',',$json); $json_str .= "]"; echo $json_str; }</pre> 变量$keyid未经过滤进入到函数getcache中 Getcache函数在文件/ phpcms/libs/functions/ global.func.php中 <pre class="prettyprint linenums">function getcache($name, $filepath='', $type='file', $config='') { pc_base::load_sys_class('cache_factory','',0); if($config) { $cacheconfig = pc_base::load_config('cache'); $cache = cache_factory::get_instance($cacheconfig)->get_cache($config); } else { $cache = cache_factory::get_instance()->get_cache($type); } return $cache->get($name, '', '', $filepath); } </pre> $cache->get()在文件/phpcms/libs/classes/cache_file.class.php <pre class="prettyprint linenums">public function get($name, $setting = '', $type = 'data', $module = ROUTE_M) { $this->get_setting($setting); if(empty($type)) $type = 'data'; if(empty($module)) $module = ROUTE_M; $filepath = CACHE_PATH.'caches_'.$module.'/caches_'.$type.'/'; $filename = $name.$this->_setting['suf']; if (!file_exists($filepath.$filename)) { return false; } else { if($this->_setting['type'] == 'array') { $data = @require($filepath.$filename);</pre> 最终$keyid变量变为$filename的一部分，造成本地文件包含漏洞的产生 PHPCMS V9.1.8 (20111014) sebug 临时解决方案： 对变量$keyid做过滤 厂商补丁： PHPCMS ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpcms.cn/
