其他
Web漏洞分析之——CVE-2019-1010153
本文为看雪论坛优秀文章
看雪论坛作者ID：孑狱天
环境：
phpstudy
seay
chrome浏览器
zzcmsV8.3（附件）
switch ($channel){
case 'ad':return showad($cs); break;
case 'zs':return showzs($cs); break;
case 'dl':return showdl($cs); break;
case 'pp':return showpp($cs); break;
case 'job':return showjob($cs); break;
case 'zx':return showzx($cs); break;
case 'zh':return showzh($cs); break;
case 'announce':return showannounce($cs); break;
case 'cookiezs':return showcookiezs($cs); break;
case 'zsclass':return showzsclass($cs); break;
case 'keyword':return showkeyword($cs); break;
case 'province':return showprovince($cs); break;
case 'sitecount':return showsitecount($cs); break;
}
global $b;//zsshow需要从zs/class.php获取$b；zxshow从s/class.php获取$b；
$channels=array('ad','zs','dl','zx','pp','job','zh','announce','cookiezs','zsclass','keyword','province','sitecount');
foreach ($channels as $value) {
if (strpos($str,"{#show".$value.":")!==false){
$n=count(explode("{#show".$value.":",$str));//循环之前取值
for ($i=1;$i<$n;$i++){
$cs=strbetween($str,"{#show".$value.":","}");//strbetween作用是提取’{#show‘与‘：’之间的字符串
if ($cs<>''){$str=str_replace("{#show".$value.":".$cs."}",fixed($cs,$value),$str);} //$cs直接做为一个整体字符串参数传入，调用时再转成数组遍历每项值
}
}
}
//重要代码分割线————————————————————————————
//自定义标签
$channels='zs,dl,zx,pp,job,wangkan,zh,company,special,baojia,ask,link,ad,about,guestbook,help';
$channel = explode(",",$channels);
for ($a=0; $a< count($channel);$a++){
//类别标签
if (strpos($str,"{@".$channel[$a]."class.")!==false) {
$n=count(explode("{@".$channel[$a]."class.",$str));//循环之前取值
for ($i=1;$i<$n;$i++){
$mylabel=strbetween($str,"{@".$channel[$a]."class.","}");
$str=str_replace("{@".$channel[$a]."class.".$mylabel."}",labelclass($mylabel,$channel[$a]),$str);
}
}
//内容标签
if (strpos($str,"{@".$channel[$a]."show.")!==false) {
$n=count(explode("{@".$channel[$a]."show.",$str));//循环之前取值
for ($i=1;$i<$n;$i++){
$mylabel=strbetween($str,"{@".$channel[$a]."show.","}");
$str=str_replace("{@".$channel[$a]."show.".$mylabel."}",labelshow($mylabel,$b,$channel[$a]),$str);
}
}
}
return $str;
}
$strout = fread($fso,filesize($fp));
if (strpos($strout,"{@")!==false)
$strout=showlabel($strout);
参考：
看雪ID： 孑狱天
https://bbs.pediy.com/user-805563.htm
推荐文章++++