Wolves Security Team

flyh4t

Administrator

Registered: 2008-10-06

Posts: 89

dedecms v53鸡肋中的一个鸡肋

dedecms v53安装文件的bug

install/index.php

$insLockfile = dirname(__FILE__).'/install_lock.txt';

……

foreach(Array('_GET','_POST','_COOKIE') as $_request)
{
     foreach($$_request as $_k => $_v) ${$_k} = RunMagicQuotes($_v);
}

//可以覆盖$insLockfile为任意值

require_once(DEDEINC.'/common.func.php');

if(file_exists($insLockfile))
{
    exit(" 程序已运行安装，如果你确定要重新安装，请先从FTP中删除 install/install_lock.txt！");
}

所以，生成了install_lock.txt，依旧还是能通过覆盖变量来访问安装文件的

Last edited by flyh4t (2008-12-31 19:55:45)