Taobao (淘寶) Security Hole? PHP Code Exposed!
This is so strange when I typed in “18 Mulsanne” in Taobao today and suddenly the result page turns into raw PHP code, it must be a serious security hole somewhere, probably it’s server got hacked. However, consequence searches all return normal result, just wired!
<?php
include "common.inc.php";
include "{$ROOT}/common/base32.inc.php";
$location_url = "/search?";
if ((isset($_SERVER["SCRIPT_NAME"]) && $_SERVER["SCRIPT_NAME"] ===
"/browse/search_auction.htm") || isset($_GET["taoke_from"])
&& $_GET["taoke_from"] === "search_auction") {
foreach ($_GET as $k => $v) {
if (!empty($v) && array_key_exists($k, $PARAMS)) {
if (in_array($k, array('q', 'loc'))) {
if (isset($_GET["_input_charset"]) && $_GET["_input_charset"]
=== 'utf-8') {
$v = urlencode(iconv('UTF-8', 'GBK', $v));
} else {
$v = urlencode($v);
}
}
$location_url .= $k . "=" . trim($v) . "&";
}
}
$location_url = rtrim($location_url, '&');
header("Location:$location_url");
exit();
}
if (($_GET["cat"] <> "
...
