xmlrpc.php， 影响：可上传任意文件到服务器。 原理：get_http_raw_post_data()是获取最原始的传递过来的数据，也是说不会因为PHP环境的magic为on的影响。 而他在check_user_pw的时候，并没有过滤，结合后门的上传没有做后缀判断，所有可以直接导致上传任意文件到服务器。 F2blog-v1.2_build_03.01_full function metaWeblog_newMediaObject ($values) { //2008-05-27 edit by Neeao global $settingInfo,$DMC, $DBPrefix,$defualtcategoryid; $userdetail = check_user_pw ($values['username'], $values['password']); $records=$DMC->fetchArray($DMC->query("SELECT * FROM `{$DBPrefix}logs` WHERE `id`='{$values['postid']}'")); if ($records['id']=='') xml_error ("Entry does not exist."); else { $struct=$values['struct']; //writetofile ('text1.php', $struct['bits']); //debug only if ($struct['bits'] && $struct['name']) { $writefilecontent=base64_decode($struct['bits']); if (file_exists("attachments/{$struct['name']}")) @unlink("attachments/{$struct['name']}"); $filenum=@fopen("attachments/{$struct['name']}","wb"); if (!$filenum) { xml_error...
xmlrpc.php， 影响：可上传任意文件到服务器。 原理：get_http_raw_post_data()是获取最原始的传递过来的数据，也是说不会因为PHP环境的magic为on的影响。 而他在check_user_pw的时候，并没有过滤，结合后门的上传没有做后缀判断，所有可以直接导致上传任意文件到服务器。 F2blog-v1.2_build_03.01_full function metaWeblog_newMediaObject ($values) { //2008-05-27 edit by Neeao global $settingInfo,$DMC, $DBPrefix,$defualtcategoryid; $userdetail = check_user_pw ($values['username'], $values['password']); $records=$DMC->fetchArray($DMC->query("SELECT * FROM `{$DBPrefix}logs` WHERE `id`='{$values['postid']}'")); if ($records['id']=='') xml_error ("Entry does not exist."); else { $struct=$values['struct']; //writetofile ('text1.php', $struct['bits']); //debug only if ($struct['bits'] && $struct['name']) { $writefilecontent=base64_decode($struct['bits']); if (file_exists("attachments/{$struct['name']}")) @unlink("attachments/{$struct['name']}"); $filenum=@fopen("attachments/{$struct['name']}","wb"); if (!$filenum) { xml_error ("Sorry, uploading file ({$struct['name']}) failed."); } flock($filenum,LOCK_EX); fwrite($filenum,$writefilecontent); fclose($filenum); } $xml_content=make_xml_piece ("struct", array('url'=>"{$settingInfo['blogurl']}/attachments/{$struct['name']}")); $body_xml=xml_generate($xml_content); send_response ($body_xml); } }
