WooYun.org

include( "../common.php" );//这个文件的功能：伪全局变量定义以及特殊字符过滤
empty($siteid) && die('error');
$v=$block_s;
if ($op=='update'){
	$blockfid=trim($blockfid);
	$string=$atc_content;
    $source=$string;
	$insert_id=0;
	...
	$source=stripslashes($string);
	if (!file_exists(SITE_CACHE.'/themes')){
		@Mkdirs(SITE_CACHE.'/themes');
	}
	$r_url=ROOT_URL.'/';
	//便于模板的移植性
	$source=str_replace($r_url,'',$source);
	$content=str_replace($r_url,'',$content);
	if ($blockfid=='oho_loginh'){
		writefile(SITE_CACHE.'/themes/'.$blockid.'h_s.php',$source);
		writefile(SITE_CACHE.'/themes/'.$blockid.'h.php',$content);
	}else{
		writefile(SITE_CACHE.'/themes/'.$blockid.$s2.'_s.php',$source);//漏洞
产生1
		writefile(SITE_CACHE.'/themes/'.$blockid.$s2.'.php',$content); //漏洞产生2
	}