深信服应用交付报表系统某处命令执行

$user_urlcoded = $_REQUEST['userID'];
 $pswd_urlcoded = $_REQUEST['userPsw'];
 $addr_urlcoded = urlencode($_SERVER['REMOTE_ADDR']);
 
 $userName = urldecode($_REQUEST['userID']);
 //这里都使用urldecode了，为啥不用其他的替换呢
 $log_type = $_REQUEST['log_type'];
 
 if(strlen($user_urlcoded)!=0 && strlen($pswd_urlcoded)!=0)
 {
  $errorMsg = exec("/usr/sbin/webui/cgi-bin/login.cgi login_check " . $user_urlcoded ." ". $pswd_urlcoded . " " .$addr_urlcoded);
  //直接就执行了
  if ($errorMsg == "0")
  {
   $_SESSION["user_name"] = $userName;
 
   // 获取当前用户权限
   get_user_permission($user_urlcoded);
 
   // 检查是否拥有权限
   if(!$_SESSION['rep_login'])
   {
    $errorMsg = "提示：对不起，您没有权限登录报表";
   }
   else if($_SESSION['rep_view'] == "0")
   {
    $errorMsg = "提示：对不起，您没有权限查看报表";
   }
 
   // 设定超时
   $_SESSION['request_time'] = time();
   $_SESSION['max_time'] = 600;
   $session_file = simplexml_load_file('/etc/sinfor/ad/sys/sys_adminif.conf');
   foreach($session_file->property as $property)
   {
    if($property['name']=="rep_timeout")
    {
     $_SESSION['max_time'] = intval($property);
    }
   }
  }
 }

http://oat.aweb.com.cn:85/report/script/login.php
 http://223.203.217.104:85/report/script/login.php