baijiacms-master 审计实验

牢七2026-03-18 8:33

01动态数据流动

为什么默认这个，观察参数流动

搜索关键字

给两个文件都打上断点，看最终流向

最终流向这里

观察代码

跳转

php 复制代码 
<?php defined('IN_IA') or exit('Access Denied');?><?php  defined('SYSTEM_IN') or exit('Access Denied');?>
        <div class="weui-msg__icon-area"><i class="<?php   if($label=='success') { ?>weui-icon-success<?php   } else  { ?>weui-icon-warn<?php   } ?> weui-icon_msg"></i></div>
    
           <div class="weui-msg__text-area">
        			<?php   if(is_array($msg)) { ?>
						<h4>MYSQL 错误：</h4>
						<p><?php  echo cutstr($msg['sql'], 300, 1);?></p>
						<p><b><?php  echo $msg['error']['0'];?> <?php  echo $msg['error']['1'];?>：</b><?php  echo $msg['error']['2'];?></p>
							<?php   }else{ ?>
				 <h2 class="weui-msg__title"><?php   echo $msg;?></h2>
				<?php   } ?> </div>
				
        <div class="weui-msg__opr-area">
            <p class="weui-btn-area">
            	
            		<?php   if($redirect) { ?>

  <a id="href" href="<?php   echo $redirect;?>" class="weui-btn <?php   if($label=='success') { ?>weui-btn_primary<?php   } else  { ?>weui-btn_warn<?php   } ?>">页面自动跳转，等待时间： <b id="wait"><?php echo $sec<=0?2:$sec?></b></a>
<script type="text/javascript">
(function(){
var wait = document.getElementById('wait'),href = document.getElementById('href').href;
var interval = setInterval(function(){
	var time = --wait.innerHTML;
	if(time == 0) {
		location.href = href;
		clearInterval(interval);
	};
}, 1000);
})();
</script>

<?php   } else { ?>
<a href="javascript:history.go(-1);"class="weui-btn weui-btn_warn">点击这里返回上一页</a>
	<?php   } 
	?>

经过不停的断点，最终发现数据流向

E:\baijiacms-master\includes\baijiacms\runner.inc.php

php 复制代码 
$class->module = $modulename;
					if (method_exists($class, $method)) {
									exit($class->$method());
					}else
					{
									exit($method." no this method");
					}
							
					}
			}
					
}
复制代码 
mobile.php
php 复制代码 
public function do_shopindex()
	{
				global $_GP;
			$this->__mobile(__FUNCTION__);
	}

E:\baijiacms-master\system\common\mobile.php

php 复制代码 
public function __mobile($f_name){
			global $_CMS,$_GP,$_W,$_GPC;
			
				if(empty($_CMS['beid']))
			{
			message("未找到站点ID");	
			}

			$filephp=$_CMS['module'].'/class/mobile/'.strtolower(substr($f_name,3)).'.php';
	
			include_once  SYSTEM_ROOT.$filephp;
	}
php 复制代码 
function message($msg, $redirect = '', $type = '',$successAutoNext=true,$sec=2) {
	global $_CMS,$_GP;
	$sec=intval($sec);
	if($redirect == 'refresh') {
		$redirect = refresh();
	}
	if($redirect == '') {
		$type = in_array($type, array('success', 'error', 'info', 'warning', 'ajax', 'sql')) ? $type : 'info';
	} else {
		$type = in_array($type, array('success', 'error', 'info', 'warning', 'ajax', 'sql')) ? $type : 'success';
	}
	if ($_CMS['isajax'] || !empty($_GET['isajax']) || $type == 'ajax') {
		if($type != 'ajax' && !empty($_GP['target'])) {
			exit("
<script type=\"text/javascript\">
parent.require(['jquery', 'util'], function($, util){
	var url = ".(!empty($redirect) ? 'parent.location.href' : "''").";
	var modalobj = util.message('".$msg."', '', '".$type."');
	if (url) {
		modalobj.on('hide.bs.modal', function(){\$('.modal').each(function(){if(\$(this).attr('id') != 'modal-message') {\$(this).modal('hide');}});top.location.reload()});
	}
});
</script>");
		} else {
			$vars = array();
			$vars['message'] = $msg;
			$vars['redirect'] = $redirect;
			$vars['type'] = $type;
			exit(json_encode($vars));
		}
	}
	if (empty($msg) && !empty($redirect)) {
		header('location: '.$redirect);
	}
	$label = $type;
	if($type == 'error') {
		$label = 'danger';
	}
	if($type == 'ajax' || $type == 'sql') {
		$label = 'warning';
	}
	include page('message');
	exit();
}

路径返回，看看可不可以控制

最后一步

有参数

php 复制代码 
public function __mobile2($f_name){
			global $_CMS,$_GP,$_W,$_GPC;
			$filephp=$_CMS['module'].'/class/mobile/'.strtolower(substr($f_name,3)).'.php';
			include_once  SYSTEM_ROOT.$filephp;
	}
php 复制代码 
function page($filename, $type = false) {
			global $_CMS,$_GP;
			    $do='';
        if($type==true)
        {
        $do=$_GP['do']."/";
      	}
			if(SYSTEM_ACT=='mobile') {
				
		
			$source=SYSTEM_ROOT . $_CMS['module']."/template/mobile/".$do."{$filename}.php";
			
			
					if (!is_file($source)) {
					$source=SYSTEM_ROOT ."common/template/mobile/".$do."{$filename}.php";
			
					}
		}else
		{
		
				$source=SYSTEM_ROOT . $_CMS['module']."/template/web/".$do."{$filename}.php";
					if (!is_file($source)) {
					$source=SYSTEM_ROOT ."common/template/web/".$do."{$filename}.php";
			
			}
		}
		return $source;
}
复制代码 
message.php
php 复制代码 
<?php defined('IN_IA') or exit('Access Denied');?><?php  defined('SYSTEM_IN') or exit('Access Denied');?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta content="telephone=no, address=no" name="format-detection">
<meta name="viewport" content="width=device-width,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no" />
<meta name="apple-mobile-web-app-capable" content="yes" /> <!-- apple devices fullscreen -->
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
<title>跳转提示</title>
<link href="<?php echo RESOURCE_ROOT;?>public/weui.min.css" rel="stylesheet">
<link href="<?php echo RESOURCE_ROOT;?>public/weui.plus.css?v=2" rel="stylesheet">
</head>
<body>
	
	<div class="page msg_success js_show" style="margin-top:50px">
    <div class="weui-msg">
        <div class="weui-msg__icon-area"><i class="<?php   if($label=='success') { ?>weui-icon-success<?php   } else  { ?>weui-icon-warn<?php   } ?> weui-icon_msg"></i></div>
    
           <div class="weui-msg__text-area">
        			<?php   if(is_array($msg)) { ?>
						<h4>MYSQL 错误：</h4>
						<p><?php  echo cutstr($msg['sql'], 300, 1);?></p>
						<p><b><?php  echo $msg['error']['0'];?> <?php  echo $msg['error']['1'];?>：</b><?php  echo $msg['error']['2'];?></p>
							<?php   }else{ ?>
				 <h2 class="weui-msg__title"><?php   echo $msg;?></h2>
				<?php   } ?> </div>
				
        <div class="weui-msg__opr-area">
            <p class="weui-btn-area">
            	
            		<?php   if($redirect) { ?>

  <a id="href" href="<?php   echo $redirect;?>" class="weui-btn <?php   if($label=='success') { ?>weui-btn_primary<?php   } else  { ?>weui-btn_warn<?php   } ?>">页面自动跳转，等待时间： <b id="wait"><?php echo $sec<=0?2:$sec?></b></a>
<script type="text/javascript">
(function(){
var wait = document.getElementById('wait'),href = document.getElementById('href').href;
var interval = setInterval(function(){
	var time = --wait.innerHTML;
	if(time == 0) {
		location.href = href;
		clearInterval(interval);
	};
}, 1000);
})();
</script>

<?php   } else { ?>
<a href="javascript:history.go(-1);"class="weui-btn weui-btn_warn">点击这里返回上一页</a>
	<?php   } 
	?>
            	
            </p>
        </div>
        <div class="weui-msg__extra-area">
            <div class="weui-footer">
                
                <p class="weui-footer__text">Copyright © 2016 baijiacms.com</p>
            </div>
        </div>
    </div>
</div>

</body>
</html>

02关键字搜索

完整域名(选填)

$_W['uniacid']是控制源头，查看

php 复制代码 
$_W=$_CMS;
$_GP = $_CMS =  array();
php 复制代码 
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
//加载渲染
	<meta charset="utf-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>百家CMS微商城V4</title>
	<link href="<?php  echo RESOURCE_ROOT;?>weengine/css/bootstrap.min.css" rel="stylesheet">
	<link href="<?php  echo RESOURCE_ROOT;?>weengine/css/font-awesome.min.css" rel="stylesheet">
	<link href="<?php  echo RESOURCE_ROOT;?>weengine/css/common.css?x=<?php  echo time()?>" rel="stylesheet">
		<link href="<?php  echo RESOURCE_ROOT;?>weengine/css/plus.css?x=<?php  echo time()?>" rel="stylesheet">
	<link href="<?php  echo RESOURCE_ROOT;?>weengine/css/main/main.css?x=<?php  echo time()?>" rel="stylesheet">
	<script>var require = { urlArgs: 'v=<?php  echo date('YmdH');?>' };</script>
		<script>window.global_website="<?php echo WEBSITE_ROOT;?>";</script>
	<script src="<?php  echo RESOURCE_ROOT;?>weengine/js/lib/jquery-1.11.1.min.js"></script>
	<script src="<?php  echo RESOURCE_ROOT;?>weengine/js/lib/bootstrap.min.js"></script>
	<script src="<?php  echo RESOURCE_ROOT;?>weengine/js/app/util.js"></script>
	<script src="<?php  echo RESOURCE_ROOT;?>weengine/js/require.js"></script>
	<script src="<?php  echo RESOURCE_ROOT;?>weengine/js/app/config.js"></script>

	<script type="text/javascript">
	if(navigator.appName == 'Microsoft Internet Explorer'){
		if(navigator.userAgent.indexOf("MSIE 5.0")>0 || navigator.userAgent.indexOf("MSIE 6.0")>0 || navigator.userAgent.indexOf("MSIE 7.0")>0) {
			alert('您使用的 IE 浏览器版本过低, 推荐使用 Chrome 浏览器或 IE8 及以上版本浏览器.');
		}
	}
	

//$_CMS['uniacid']=$_CMS['beid'];
//$_CMS['beid']=$_GP['beid'];

//创建全局变量，动态显示
	window.sysinfo = {
<?php  if(!empty($_W['uniacid'])) { ?>
如果不为空，json
		'uniacid': '<?php  echo $_W['uniacid'];?>',
<?php  } ?>
<?php  if(!empty($_W['acid'])) { ?>

		'acid': '<?php  echo $_W['acid'];?>',
<?php  } ?>
<?php  if(!empty($_W['openid'])) { ?>
		'openid': '<?php  echo $_W['openid'];?>',
<?php  } ?>
<?php  if(!empty($_W['uid'])) { ?>
		'uid': '<?php  echo $_W['uid'];?>',
<?php  } ?>

		'siteroot': '<?php  echo $_W['siteroot'];?>',
		'siteurl': '<?php  echo $_W['siteurl'];?>',
		'attachurl': '<?php  echo $_W['attachurl'];?>',
		'attachurl_local': '<?php  echo $_W['attachurl_local'];?>',
		'attachurl_remote': '<?php  echo $_W['attachurl_remote'];?>',
<?php  if(defined('MODULE_URL')) { ?>
		'MODULE_URL': '<?php echo MODULE_URL;?>',
<?php  } ?>
		'cookie' : {'pre': '<?php  echo $_W['config']['cookie']['pre'];?>'}
	};





//全局变量打印
	window.uploader_file_fetch="<?php echo create_url("mobile",array("do"=>"file","act"=>"public","op"=>"fetch"));?>";
	window.uploader_file_local="<?php echo create_url("mobile",array("do"=>"file","act"=>"public","op"=>"local"));?>";
		window.uploader_file_image="<?php echo create_url("mobile",array("do"=>"file","act"=>"public","op"=>"upload","type"=>"image"));?>";
		window.uploader_file_audio="<?php echo create_url("mobile",array("do"=>"file","act"=>"public","op"=>"audio"));?>";
				window.uploader_file_delete="<?php echo create_url("mobile",array("do"=>"file","act"=>"public","op"=>"delete"));?>";
				window.resource_url="<?php  echo RESOURCE_ROOT;?>";
				window.public_utility_link="";
						window.public_utility_pageLink="";
						window.public_utility_newsLink="";
						window.public_utility_articleLink="";
						window.public_utility_phoneLink="";
						window.public_utility_moduleLink="";
							window.public_utility_selectIcon="<?php echo create_url("site",array("do"=>"icon","act"=>"utility"));?>";
							window.public_utility_selectEmojiComplete="<?php echo create_url("site",array("do"=>"emoji","act"=>"utility"));?>";
	</script>
</head>
<body>
	

//
<div class="main_header">
	<div class="main_logo">
		<a href=""><img src="<?php  echo RESOURCE_ROOT;?>weengine/css/main/logow.png"></a>
	</div>
	<div class="main_nav_cont">

		<ul  class="main_nav">
			
			<a href="<?php  echo create_url('site',array('act' => 'manager','do' => 'store','op'=>'display'))?>">系统管理</a></li>
            	
    
			
		</ul>

		<div class="main_login">
			<span  class="main_change_link" style="color: #FFF">您好，<?php echo $GLOBALS['_CMS'][WEB_SESSION_ACCOUNT]['username'];?></span>
		
<ul  class="main_nav_right">
		<li><i class="nav-first-i"></i> <a href="http://www.baijiacms.com/" target="_blank">官方首页</a> <i></i>
			</li>	<li><i class="nav-first-i"></i> <a href="<?php  echo create_url('site',array('act' => 'manager','do' => 'changepwd'))?>">修改密码</a> <i></i>
			</li>
		<li><i class="nav-first-i"></i> <a href="<?php  echo create_url('mobile',array('act' => 'public','do' => 'logout'))?>">退出系统</a> <i></i>
			</li>
		</ul>
	<span  class="main_change_link" >&nbsp;</span>
             
		</div>

	</div>

</div>

<!--[if lte IE 7]><div class="ietip ietipbg"></div><div  class="ietip ietiptext">您的浏览器太旧了，为了获得更好的体验，请升级您的浏览器！</div><![endif]-->
<div class="main_wrap" >
		<div class="main_wrap-bg">

			<div class="main_sidebar">
				<div class="main_subnav" >
					
					<?php include page('system_menu/system');?> 
					



				</div>
			</div>
			<div id="main_tgy" class="main_tgy" >
	<a  id="main_celan" class="main_celan" title="关闭侧栏"></a>
	
	

<script>
	$("#main_celan").click(function(){
if($(this).hasClass("main_celan main_celanon")){
$('.main_sidebar').animate({marginLeft:"0px"});
$('#main_tgy').animate({marginLeft:"200px"});
$('#main_celan').removeClass('main_celanon');
$.cookie("celan",null)}else{$('.main_sidebar').animate({marginLeft:"-210px"});
$('#main_tgy').animate({marginLeft:"0px"});
$('#main_celan').addClass('main_celanon');
$.cookie("celan","1",{expires:7})}
});
	</script>
php 复制代码 
<?php defined('SYSTEM_IN') or exit('Access Denied');?>
//包含可以复用的代码文件
<?php include page("system_header");?>
     <form  method="post" class="form-horizontal form">
 <div class="panel ">
        
            <h3 class="custom_page_header">   店铺编辑   </h3>
       <div class="panel-body">
       //获取id
            	<input type="hidden" name="id" value="<?php echo $store['id'];?>" />
            	<div class="form-group">
                    <label class="col-xs-12 col-sm-3 col-md-2 control-label">店铺名称<span style="color:red">*</span></label>
                    <div class="col-sm-9 col-xs-12">
                       	<input type="text" name="sname" class="form-control" value="<?php echo $store['sname'];?>" />
                    </div>
                </div>

 	<div class="form-group">
                    <label class="col-xs-12 col-sm-3 col-md-2 control-label">绑定域名<span style="color:red">*</span></label>
                    <div class="col-sm-9 col-xs-12">
                       	<input type="text" name="website" class="form-control" value="<?php echo $store['website'];?>" />
                   <span class="help-block">如：***.baijiacms.com，请注意格式（***部分可为你定义的英文）不含二级目录和http。</span>
                    </div>
                </div>

 	<div class="form-group">
                    <label class="col-xs-12 col-sm-3 col-md-2 control-label">完整域名(选填)</label>
                    <div class="col-sm-9 col-xs-12">
                       	<input type="text" name="fullwebsite" class="form-control" value="<?php echo $store['fullwebsite'];?>" />
                    <span class="help-block"><span style="color:red">可空，系统会自动完善</span>。如特殊情况需手动修改，请注意格式如：http://***/demo/，请注意格式（***部分可为你定义的域名）。</span>
                    </div>
                </div>
            	
            	 	<div class="form-group">
                    <label class="col-xs-12 col-sm-3 col-md-2 control-label">是否开启：</label>
                     <div class="col-sm-9 col-xs-12">
                       
                        <label class="radio-inline">
                            <input type="radio" name="status" value="1'" <?php  if($store['isclose'] == 1) { ?>checked="true"<?php  } ?>> 关闭
                        </label>
                        <label class="radio-inline">
                            <input type="radio" name="status" value="0'" <?php  if($store['isclose'] == 0) { ?>checked="true"<?php  } ?>> 开启
                        </label>
                         
                    </div>
                </div>
                
                
                 	<div class="form-group">
                    <label class="col-xs-12 col-sm-3 col-md-2 control-label">前台访问链接</label>
                    <div class="col-sm-9 col-xs-12">
                    	   <?php if(!empty($store['id'])){?>
                       	<input  readonly="readlony" type="text" name="mobile_url" class="form-control" value="<?php  if(empty($store['fullwebsite'])) { ?>http://<?php echo $store['website'];?>/<?php }else{ ?><?php echo $store['fullwebsite'];?><?php } ?>index.php" /><a target="_blank" href="<?php  if(empty($store['fullwebsite'])) { ?>http://<?php echo $store['website'];?>/<?php }else{ ?><?php echo $store['fullwebsite'];?><?php } ?>index.php">预览</a>
                    <?php }else{?>
													提交后生成链接
														<?php }?>
                    
                    </div>
                </div>
            	
            	
            	    	<div class="form-group">
                    <label class="col-xs-12 col-sm-3 col-md-2 control-label">后台访问链接</label>
                    <div class="col-sm-9 col-xs-12">
                    	   <?php if(!empty($store['id'])){?>
                       	<input  readonly="readlony" type="text" name="mobile_url" class="form-control" value="<?php  if(empty($store['fullwebsite'])) { ?>http://<?php echo $store['website'];?>/<?php }else{ ?><?php echo $store['fullwebsite'];?><?php } ?>admin.php" /><a target="_blank" href="<?php  if(empty($store['fullwebsite'])) { ?>http://<?php echo $store['website'];?>/<?php }else{ ?><?php echo $store['fullwebsite'];?><?php } ?>admin.php">预览</a>
                    <?php }else{?>
													提交后生成链接
														<?php }?>
                    
                    </div>
                </div>
            	
            	
            	<div class="form-group">
                    <label class="col-xs-12 col-sm-3 col-md-2 control-label"></label>
                    <div class="col-sm-9 col-xs-12">
                        
                            <input type="submit" name="submit" value="提交" class="btn btn-primary col-lg-1">
                      </div>
            </div>
            	
        
            </div>
      </div>
</form>
<?php include page("footer-base");?>
php 复制代码 
<?php defined('IN_IA') or exit('Access Denied');?> 

<script language="javascript">
    require(['bootstrap'], function ($) {});
     $(function(){
          
            var height1=$(".main_wrap").height(); 
            var height2=$(".main_tgy").height();
            if(parseInt(height1) > parseInt(height2)){
                $(".main_tgy").css({'min-height': (height1+50)});
            };
            
          });
</script>

 
			</div>


		</div>
	</div>

</body>
</html>

页面对照

相关推荐
zklgin2 小时前
MySQL错误-this is incompatible with sql_mode=only_full_group_by完美解决方案
android·sql·mysql
刘信的csdn2 小时前
Android Audio模块框架和基础属性概念讲解
android
回到原点的码农2 小时前
MySQL-mysql zip安装包配置教程
android·mysql·adb
mygljx11 小时前
【MySQL 的 ONLY_FULL_GROUP_BY 模式】
android·数据库·mysql
冬奇Lab13 小时前
AudioTrack音频播放流程深度解析
android·音视频开发·源码阅读
青莲84316 小时前
查找算法详解
android·前端
青莲84316 小时前
排序算法详解
android·前端
zd20057216 小时前
用摩斯密码「听」时间：一款安卓报时应用的诞生
android
热门推荐
01GitHub 镜像站点02Qwen3.5 开源全解析：从 0.8B 到 397B，代际升级 + 全场景选型指南03OpenClaw 使用和管理 MCP 完全指南04UV安装并设置国内源05OpenClaw Control UI安全上下文访问配置06OpenClaw macOS 完整安装与本地模型配置教程（实战版）07本地部署 OpenClaw + DeepSeek-R1 完全指南08Claude Code + GLM4.7 避坑指南：解决 Unable to connect to Anthropic services09让 Trae IDE 智能体 “读懂”文档 Excel+PDF+DOCX ：mcp-documents-reader 工具使用指南10小黑课堂计算机二级WPSoffice题库软件下载安装教程（2026年3月最新版）