phpmyadmin任意文件包含漏洞分析（含演示）

public static function factory($type)
    {
        include_once ‘./libraries/gis/pma_gis_geometry.php‘;
        $type_lower = strtolower($type);
        if (! file_exists(‘./libraries/gis/pma_gis_‘ . $type_lower . ‘.php‘)) {
            return false;
        }
        if (include_once ‘./libraries/gis/pma_gis_‘ . $type_lower . ‘.php‘) {
            switch(strtoupper($type)) {
            case ‘MULTIPOLYGON‘ :
                return PMA_GIS_Multipolygon::singleton();
            case ‘POLYGON‘ :
                return PMA_GIS_Polygon::singleton();
            case ‘MULTIPOINT‘ :
                return PMA_GIS_Multipoint::singleton();
            case ‘POINT‘ :
                return PMA_GIS_Point::singleton();
            case ‘MULTILINESTRING‘ :
                return PMA_GIS_Multilinestring::singleton();
            case ‘LINESTRING‘ :
                return PMA_GIS_Linestring::singleton();
            case ‘GEOMETRYCOLLECTION‘ :
                return PMA_GIS_Geometrycollection::singleton();
            default :
                return false;
            }
        } else {
            return false;
        }
}

// Get data if any posted
$gis_data = array();
if (PMA_isValid($_REQUEST[‘gis_data‘], ‘array‘)) {
    $gis_data = $_REQUEST[‘gis_data‘];
}
$gis_types = array(
    ‘POINT‘,
    ‘MULTIPOINT‘,
    ‘LINESTRING‘,
    ‘MULTILINESTRING‘,
    ‘POLYGON‘,
    ‘MULTIPOLYGON‘,
    ‘GEOMETRYCOLLECTION‘
);
// Extract type from the initial call and make sure that it‘s a valid one.
// Extract from field‘s values if availbale, if not use the column type passed.
if (! isset($gis_data[‘gis_type‘])) {
    if (isset($_REQUEST[‘type‘]) && $_REQUEST[‘type‘] != ‘‘) {
        $gis_data[‘gis_type‘] = strtoupper($_REQUEST[‘type‘]);
    }
    if (isset($_REQUEST[‘value‘]) && trim($_REQUEST[‘value‘]) != ‘‘) {
        $start = (substr($_REQUEST[‘value‘], 0, 1) == "‘") ? 1 : 0;
        $gis_data[‘gis_type‘] = substr(
            $_REQUEST[‘value‘], $start, strpos($_REQUEST[‘value‘], "(") - $start
        );
    }
    if ((! isset($gis_data[‘gis_type‘]))
        || (! in_array($gis_data[‘gis_type‘], $gis_types))
    ) {
        $gis_data[‘gis_type‘] = $gis_types[0];
    }
}
$geom_type = $gis_data[‘gis_type‘];
// Generate parameters from value passed.
$gis_obj = PMA_GIS_Factory::factory($geom_type);

$token_mismatch = true;
if (PMA_isValid($_REQUEST[‘token‘])) {
    $token_mismatch = ($_SESSION[‘ PMA_token ‘] != $_REQUEST[‘token‘]);
}
if ($token_mismatch) {
    /**
     *  List of parameters which are allowed from unsafe source
     */
    $allow_list = array(
        /* needed for direct access, see FAQ 1.34
         * also, server needed for cookie login screen (multi-server)
         */
        ‘server‘, ‘db‘, ‘table‘, ‘target‘, ‘lang‘,
        /* Session ID */
        ‘phpMyAdmin‘,
        /* Cookie preferences */
        ‘pma_lang‘, ‘pma_collation_connection‘,
        /* Possible login form */
        ‘pma_servername‘, ‘pma_username‘, ‘pma_password‘,
        /* Needed to send the correct reply */
        ‘ajax_request‘,
        /* Permit to log out even if there is a token mismatch */
        ‘old_usr‘
    );
    /**
     * Allow changing themes in test/theme.php
     */
    if (defined(‘PMA_TEST_THEME‘)) {
        $allow_list[] = ‘set_theme‘;
    }
    /**
     * Require cleanup functions
     */
    include ‘./libraries/cleanup.lib.php‘;
    /**
     * Do actual cleanup
     */
    PMA_remove_request_vars($allow_list);
}

$ token_mismatch = true ;

if ( PMA_isValid ( $ _REQUEST [ ‘token‘ ] ) ) {

$ token_mismatch = ( $ _SESSION [ ‘ PMA_token ‘ ] != $ _REQUEST [ ‘token‘ ] ) ;

}

if ( $ token_mismatch ) {

/**

*  List of parameters which are allowed from unsafe source

*/

$ allow_list = array (

/* needed for direct access, see FAQ 1.34

* also, server needed for cookie login screen (multi-server)

*/

‘server‘ , ‘db‘ , ‘table‘ , ‘target‘ , ‘lang‘ ,

/* Session ID */

‘phpMyAdmin‘ ,

/* Cookie preferences */

‘pma_lang‘ , ‘pma_collation_connection‘ ,

/* Possible login form */

‘pma_servername‘ , ‘pma_username‘ , ‘pma_password‘ ,

/* Needed to send the correct reply */

‘ajax_request‘ ,

/* Permit to log out even if there is a token mismatch */

‘old_usr‘

) ;

/**

* Allow changing themes in test/theme.php

*/

if ( defined ( ‘PMA_TEST_THEME‘ ) ) {

$ allow_list [ ] = ‘set_theme‘ ;

}

/**

* Require cleanup functions

*/

include ‘./libraries/cleanup.lib.php‘ ;

/**

* Do actual cleanup

*/

PMA_remove_request_vars ( $ allow_list ) ;

}

./libraries/gis/pma_gis_/../../../../u1.gif