Akcms Code Execution Vulnerability

The background template getshell of akcms dug up last week felt nothing new, and then carefully looked at the code and found a promising hole and code execution vulnerability, in addition, the problematic function is provided by the author to the website users for secondary development. That is to say, the problem is amplified to a greater extent.

0 × 01. Principle Analysis

The vulnerability mainly exists in the ak_if function in the include \ common. func. php file. Check the code first.

The variable $ variable in the eval function parameter is inserted into the function without any processing. The main purpose of ak_if function is to provide users with a simple interface for logical judgment. Compare this code in version 4.1.

It can be found that the eval function call statement is different. In versions earlier than 4.1.4, this function does not call the eval function. However, in 4.1.4, the author adds this statement to increase ak_if's judgment on complex logic.

This leads to arbitrary php code execution if you have control over the $ variable.

0 × 02. Vulnerability Verification

To reproduce the vulnerability, I downloaded the author's blog System Based on akcms2.4.2 and called this function in the \ cache \ templates \ % 7d%7d3%7d3a5c77%%comments.htm. php template.

After tracking the variables, we found that this template is used when the user replies to a question from the viewer. Therefore, to exploit this vulnerability, you need a background account that can reply to a viewer's question. For exploitation process

0 × 03. Summary

Vulnerability functions are provided to the website builder for expansion. If the builder uses the ak_if function to interact with the front-end user, the consequences will be unimaginable.

PS: The last time I wrote the akcms template vulnerability audit post, many kids shoes replied that the entire audit process should be written for reference. In fact, code auditing is a very boring process. Maybe you may have tried your best to read the source code for a week. At the end of the article, you will find that the original two or three sentences can be understood. In the past two days, I will summarize the process of code auditing, post a post, and share my methods with you.