星光贴吧 1.3 后台拿 Shell

Common/common.function.php：

function write_file($l1, $l2=''){  //写文件
        $dir = dirname($l1);
        if(!is_dir($dir)){
                mkdirss($dir);
        }
        return @file_put_contents($l1, $l2);
}
function read_file($l1){
        return @file_get_contents($l1);
}
// 数组保存到文件
function arr2file($filename, $arr=''){
        if(is_array($arr)){
                $con = var_export($arr,true);
        } else{
                $con = $arr;
        }
        $con = "<?php\nreturn $con;\n?>";//\n!defined('IN_MP') && die();\nreturn $con;\n
        write_file($filename, $con);
}

admin\module\extendMod.class.php：

 $array=$_POST;        //POST提交的数组赋值给$array
           if(!empty($array['ads_name_sub'])){
                    if($this->model->table('ads')->where('        adsname="'.trim($_POST['ads_name_sub']).'"')->find()){
                                $this->error('该广告标识已经存在,请重新填写一个广告标识！');
                        }
                        $data['adsname'] = trim($array['ads_name_sub']);    //文件名
                        $data['adscontent'] = stripslashes(trim($array['ads_content_sub']));  //内容
                        $this->model->table('ads')->data($data)->insert($data);
                        write_file(ROOT_PATH.'/data/ads/'.$data['adsname'].'.js',t2js($data['adscontent']));   //写SHELL