ECShop网店系统<=V2.6.2 后台拿webshell

if ($_REQUEST[\’act\’] == \’sync\’) { $size = 100; …… $tasks = array(); if ($task_del > 0) { $tasks[] = array(\’task_name\’=>sprintf($_LANG[\’task_del\’], $task_del),\’task_status\’=>\’\’ . $_LANG[\’task_uncomplete\’] . \’\’); $sql = \”SELECT user_name FROM \” . $ecs->table(\’users\’) . \” WHERE flag = 2\”; $del_list = $db->getCol($sql);//$del_list未初始化 } if ($task_rename > 0) { $tasks[] = array(\’task_name\’=>sprintf($_LANG[\’task_rename\’], $task_rename),\’task_status\’=>\’\’ . $_LANG[\’task_uncomplete\’] . \’\’); $sql = \”SELECT user_name, alias FROM \” . $ecs->table(\’users\’) . \” WHERE flag = 3\”; $rename_list = $db->getAll($sql);//$rename_list未初始化 } if ($task_ignore >0) { $sql = \”SELECT user_name FROM \” . $ecs->table(\’users\’) . \” WHERE flag = 4\”; $ignore_list = $db->getCol($sql);//$ignore_list未初始化 } …… /* 保存修改日志 */ $fp = @fopen(ROOT_PATH . DATA_DIR . \’/integrate_\’ . $_SESSION[\’code\’] . \’_log.php\’, \’wb\’); $log = \’\’; if (isset($del_list)) { $log .= \’$del_list=\’ . var_export($del_list,true) . \’;\’; } if (isset($rename_list)) { $log .= \’$rename_list=\’ . var_export($rename_list, true) . \’;\’; } if (isset($ignore_list)) { $log .= \’$ignore_list=\’ . var_export($ignore_list, true) . \’;\’; } //未做过滤，直接写log fwrite($fp, $log); fclose($fp); $smarty->assign(\’tasks\’, $tasks); $smarty->assign(\’ur_here\’,$_LANG[\’user_sync\’]); $smarty->assign(\’size\’, $size); $smarty->display(\’integrates_sync.htm\’); }