PHPCMS V9.1.13 Arbitrary File Inclusion Vulnerability Analysis

Recently, the PHPCMS V9.1.13 Arbitrary File Inclusion Vulnerability was reported. The new version (v9.1.16) has fixed the vulnerability.

Download PHPCMS V9.1.13 and decompress it.

Here I will use the efficient analysis capability inherent in Linux to quickly locate functions with vulnerabilities. I am too lazy to look for the code at the entry point.

First, let's look at the url that triggers the vulnerability:/index. php? M = search & c = index & a = public_get_suggest_keyword & url = test & q =.../../phpsso_server/caches/configs/database. php

I use public_get_suggest_keyword as a keyword to search for it in the source code:

1, cd phpcms_v9_GBK/install_package/

2, grep-H-n-R "public_get_suggest_keyword "*

Parameter description:-H indicates the file name,-n indicates the row number, and-R indicates the recursive directory to find all files.

Result

In row 198th of the phpcms/modules/search/index. php file, find the function Definition: public function public_get_suggest_keyword ()

Vim phpcms/modules/search/index. php

Then press shift + colon in vim to enter the vim command line mode. Enter set number to display the row number, and then enter 198 to directly jump to the 198 line:

198 public function public_get_suggest_keyword (){

199 $ url = $ _ GET ['url']. '& q ='. $ _ GET ['q'];

200

201 $ res = @ file_get_contents ($ url );

202 if (CHARSET! = 'Gbk '){

203 $ res = iconv ('gbk', CHARSET, $ res );

204}

205 echo $ res;

206}

Note that the file_get_contents function of Row 3 can obtain the content of the specified file, and can directly read the content of any file without filtering.

In the new version, this function has been fixed:

198 public function public_get_suggest_keyword (){

199 $ url = $ _ GET ['url']. '& q ='. $ _ GET ['q'];

200 $ trust_url = array ('c8430fcf851e85818b546addf5bc4dd3 ');

201 $ urm_md5 = md5 ($ url );

202 if (! In_array ($ urm_md5, $ trust_url) exit;

203

204 $ res = @ file_get_contents ($ url );

205 if (CHARSET! = 'Gbk '){

206 $ res = iconv ('gbk', CHARSET, $ res );

207}

208 echo $ res;

209}