35 fault in command execution and repair caused by incomplete dangerous filtering of hedgehog website construction system

 

Brief description:

Hedgehog website construction is a new generation of standardized website construction service launched by 35 Interconnected Systems, which greatly reduces site construction and update costs. Hedgehog has complete functions and is easy to use. It is very popular among small and medium-sized enterprises. This vulnerability is caused by incomplete filtering of dangerous code and can be used directly to obtain the site, causing great harm ......

Detailed description:

Dangerous code filtering in PHP is incomplete, and webshell can be directly obtained ......

 

The user management background pop-up window file notice. php is simply filtered out

<?

 

Phpinfo ();

 

?>

 

But there is no other way to filter the PHP file:

<Script language = "php">

 

Phpinfo ();

 

</Script>

 

You can add this dangerous Code directly in the background editor code format. This vulnerability is generated!

Proof of vulnerability:

The kitchen knife is connected, as shown in the following figure:

 

 

 

Solution:

Filter related dangerous code...