Waifeng local file inclusion and repair

You can continue to use it on one server ....
 
Phpwind: x: 502: 0:/www/bbs.weiphone.com/:/bin/bash
Weand: x: 503: 503:/www/bbs.weand.com:/sbin/nologin
Editor: x: 504: 500:/www:/bin/bash
Useract: x: 505: 505:/www/act.weiphone.com/:/sbin/nologin
Detailed Description: first, the Magento open source program default configuration used by Weifeng network mall. Open source found that Weifeng mall uses the Magento 1.4.X version.
With the latest zend framework vulnerability, attackers can directly read arbitrary files.
Zend Framework Local File Disclosure SSV-ID: 60242
Part of the passwd file is intercepted:
 
Phpwind: x: 502: 0:/www/bbs.weiphone.com/:/bin/bash
Weand: x: 503: 503:/www/bbs.weand.com:/sbin/nologin
Editor: x: 504: 500:/www:/bin/bash
Useract: x: 505: 505:/www/act.weiphone.com/:/sbin/nologin

 
 
Solution:

Magento has fixed this bug in version 1.7.0.2.
Considering that Weifeng has carried out a lot of secondary development on Magento. You can use this method:
 
In the wwwroot, navigate to/app/code/core/Mage/Api/controllers.
Open XmlrpcController. php for editing.
Comment out or delete the body of the method: public indexAction ()