phpcms v9全系列URL規則任意代碼執行漏洞修復方法 |
涉及文件: step1.將文件中如下代碼: $this->url_ifok($_POST['info']['urlrule']) 修改為: $this->url_ifok($_POST['info']['urlrule'], $_POST['info']['ishtml']) step2.將如下函數: public function url_ifok($url){ $urldb = explode("|",$url); foreach($urldb as $key=>$value){ if(strpos($value, "index.php") === 0){ $value = substr($value,'9'); } if( stripos($value, "php") !== false){ return false; } } return true; } 替換為: public function url_ifok($url, $ishtml){ $urldb = explode("|",$url); foreach($urldb as $key=>$value){ if(!intval($ishtml) && strpos($value, "index.php") === 0){ $value = substr($value,'9'); } if( stripos($value, "php") !== false){ return false; } } return true; } |