WooYun.org

$key = "oeit*&^df_";
$uname = $_GET['uname'];
$action = $_GET['action'];
if ( $_GET['k'] != md5( $action.$uname.$key ) ) //有个验证 算一下就好。
{
				exit( );
}
switch ( $action )
{
				case "show4" :
								$pfd = popen( "/srun3/bin/online_user -4 -u ".$uname, "r" ); //这里
								if ( $pfd )
								{
												while ( $con = fgets( $pfd, 500 ) )
												{
																echo $con."\n";
												}
												pclose( $pfd );
												break;
								}