Faults caused by Phpcms v9 bugs

1. Description of the situation:

a "  60g about. After the discovery of site root directory /sso_server/ UploadFile file 60g /sso_server/uploadfile/02/01/02/10960/22/ .tar.gz The file about 60g The backup file for the entire station.

b) There are 2 php files under/SSO_SERVER/UPLOADFILE/02/01/02/10960/22, After detection is a Trojan PHP program.

c) after the system log check to determine the operating system and httpd platform work properly, the problem may be in the user upload verification.

d) simulate user behavior. The file Trojan php program was uploaded using the phpcms vulnerability. (phpcms is open source, exploit is upload verification problem)

2. Solution:

a) resolve the phpcms v9 Upload Verification Vulnerability issue.

b) from the system security point of view for uploading code, processing permissions, even if the upload can not be executed. Avoid the effects of malicious code.

Http://www.myhack58.com/Article/html/3/62/2014/43746.htm the link is explained by the vulnerability.

Black source code: see attachment

This article is from the "Elder Don" blog, please be sure to keep this source http://zhanglaotang.blog.51cto.com/3196967/1440908

Faults caused by Phpcms v9 bugs