看到大牛已放出exp，我也放出我的分析！大家将就下看吧

exp在http://hi.baidu.com/toby57/blog/item/686b70ece294cfdc2f2e2183.html

................................................................................................................................................

by:xhm1n9

article_add.php
........................
else if($dopost=='save')
{
include(DEDEMEMBER.'/inc/archives_check.php');

//分析处理附加表数据
$inadd_f = $inadd_v = '';
if(!empty($dede_addonfields))
{
   $addonfields = explode(';',$dede_addonfields);
............................................ //省略部份代码
     $inadd_f .= ','.$vs[0];
     $inadd_v .= " ,'".${$vs[0]}."' ";
    }
   }
}
..........................................
$addtable = trim($cInfos['addtable']);
if(empty($addtable))
{
   ......................................
}
else
{
   $inquery = "INSERT INTO `{$addtable}`(aid,typeid,userip,redirecturl,templet,body{$inadd_f}) Values('$arcID','$typeid','$userip','','','$body'{$inadd_v})";
   if(!$dsql->ExecuteNoneQuery($inquery))
   {
..........................................
   }
}
..........................................
$artUrl = MakeArt($arcID,true);     //利用地方(arc.archives.functions.php有定义)


function MakeArt($aid,$ismakesign=false)
{
global $cfg_makeindex,$cfg_basedir,$cfg_templets_dir,$cfg_df_style;
include_once(DEDEINC.'/arc.archives.class.php');
if($ismakesign)
{
   $envs['makesign'] = 'yes';
}
$arc = new Archives($aid);
$reurl = $arc->MakeHtml();           //arc.archives.class.php有定义
............................
}


arc.archives.class.php
class Archives
{
................
function __construct($aid)
{
............
   if($this->ChannelUnit->ChannelInfos['addtable']!='')
    {
     $query = "SELECT * FROM `{$this->ChannelUnit->ChannelInfos['addtable']}` WHERE `aid` = '$aid'";
     $this->addTableRow = $this->dsql->GetOne($query);
    }
........................
if($this->ChannelUnit->ChannelInfos['addtable']!='' && $this->ChannelUnit->ChannelInfos['issystem']!=-1)
    {
     if(is_array($this->addTableRow))
     {
     ...............................
      $this->Fields['templet'] = $this->addTableRow['templet'];//注意1
     ......................................
     }
    }
    .............................
}

function MakeHtml($isremote=0)
{
   global $cfg_remote_site,$fileFirst;
   if($this->IsError)
   {
    return '';
   }
   $this->Fields["displaytype"] = "st";
   //预编译$th
   $this->LoadTemplet();              //触发1
  
......................................//省略部份代码
     $this->ParseDMFields($i,1);
   $this->dtp->SaveTo($truefilename); //触发2
......................................
}
继续跟(触发1)$this->LoadTemplet();        //arc.archives.class.php有定义

function LoadTemplet()
{
   if($this->TempSource=='')
   {
    $tempfile = $this->GetTempletFile();                     //注意2
    if(!file_exists($tempfile) || !is_file($tempfile))
    {
     echo "文档ID：{$this->Fields['id']} - {$this->TypeLink->TypeInfos['typename']} - {$this->Fields['title']}<br />";
     echo "模板文件不存在，无法解析文档！";
     exit();
    }
    $this->dtp->LoadTemplate($tempfile);                  //触发3
    $this->TempSource = $this->dtp->SourceString;
   }
   else
   {
    $this->dtp->LoadSource($this->TempSource);
   }
}

看注意2 的$this->GetTempletFile()           //arc.archives.class.php有定义

function GetTempletFile()
{
   global $cfg_basedir,$cfg_templets_dir,$cfg_df_style;
   $cid = $this->ChannelUnit->ChannelInfos['nid'];
   if(!empty($this->Fields['templet']))                  //注意3
   {
    $filetag = MfTemplet($this->Fields['templet']);
    if( !ereg('/', $filetag) ) $filetag = $GLOBALS['cfg_df_style'].'/'.$filetag;
   }
   else
   {
    $filetag = MfTemplet($this->TypeLink->TypeInfos["temparticle"]);
   }
.......................................
   if($cid=='spec')
   {
    if( !empty($this->Fields['templet']) )
    {
     $tmpfile = $cfg_basedir.$cfg_templets_dir.'/'.$filetag;
    }
    else
    {
     $tmpfile = $cfg_basedir.$cfg_templets_dir."/{$cfg_df_style}/article_spec.htm";
    }
   }
...........................................
     return $tmpfile;
}
注意3中的值来自注意1是通过查表得来的，控制了它就等于控制了任意模板,然后通过触发3来触发漏洞
看下怎么控制注意1的值
article_edit.php

......................
else if($dopost=='save')
{ ....................
if(!empty($dede_addonfields))
{
   $addonfields = explode(';',$dede_addonfields);
   if(is_array($addonfields))
   {
........................
             ${$vs[0]} = GetFieldValueA(${$vs[0]},$vs[1],$aid);
     $inadd_f .= ','.$vs[0]." ='".${$vs[0]}."' ";
    
   }
}
...................
if($addtable!='')
{
   $upQuery = "Update `$addtable` set typeid='$typeid',body='$body'{$inadd_f},userip='$userip' where aid='$aid' ";
   if(!$dsql->ExecuteNoneQuery($upQuery))
   {..............
   }
}
....................
}
$dede_addonfields没有过滤，我们可以构造$inadd_f为,templet='上传的模板图片地址',包含我们的图片后，再通过触发2来生成图片里的后门!