The source code of an apicloud website is leaked. Getshell further affects members.

The source code of an apicloud website is leaked. Getshell further affects members.

The leakage of source code affects 17 W members.

Http://community.apicloud.com/bbs.zip

 

View the uc_key. discuz has a great risk of keys. You can reset any user password to get shell.

 

 

 

 

[/var/www/html/bbs/uc_server/]$ ifconfigeth0      Link encap:Ethernet  HWaddr 28:6E:D4:89:91:54            inet addr:10.124.25.253  Bcast:10.124.25.255  Mask:255.255.255.0          inet6 addr: fe80::2a6e:d4ff:fe89:9154/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1          RX packets:2434421933 errors:0 dropped:0 overruns:0 frame:0          TX packets:1823263521 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:505043307551 (470.3 GiB)  TX bytes:3004404434737 (2.7 TiB)          Interrupt:164 lo        Link encap:Local Loopback            inet addr:127.0.0.1  Mask:255.0.0.0          inet6 addr: ::1/128 Scope:Host          UP LOOPBACK RUNNING  MTU:16436  Metric:1          RX packets:18390199 errors:0 dropped:0 overruns:0 frame:0          TX packets:18390199 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:0           RX bytes:1919284411 (1.7 GiB)  TX bytes:1919284411 (1.7 GiB)

 

Solution:

Do not place the source code in the directory and change the key.