由于文件get_linkage.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。
相关代码如下：
/api/ get_linkage.php
<code>case 'ajax_select':
$parent_id = $_GET['parent_id'] ? intval($_GET['parent_id']) : 0;
$keyid = $_GET['keyid'];
ajax_select($parent_id,$keyid);
函数ajax_select在相同文件中有定义
function ajax_select($parentid,$keyid) {
$datas = getcache($keyid,'linkage');
$infos = $datas['data'];
$json_str = "[";
$json = array();
foreach($infos AS $k=>$v) {
if($v['parentid'] == $parentid) {
$r = array('region_id' => $v['linkageid'],
'region_name' => $v['name']);
$json[] = JSON($r);
}
}
$json_str .= implode(',',$json);
$json_str .= "]";
echo $json_str;
}</code>
变量$keyid未经过滤进入到函数getcache中
Getcache函数在文件/ phpcms/libs/functions/ global.func.php中
<code>function getcache($name, $filepath='', $type='file', $config='') {
pc_base::load_sys_class('cache_factory','',0);
if($config) {
$cacheconfig = pc_base::load_config('cache');
$cache = cache_factory::get_instance($cacheconfig)->get_cache($config);
} else {
$cache = cache_factory::get_instance()->get_cache($type);
}
return $cache->get($name, '', '', $filepath);
}
</code>
$cache->get()在文件/phpcms/libs/classes/cache_file.class.php
<code>public function get($name, $setting = '', $type = 'data', $module = ROUTE_M) {
$this->get_setting($setting);
if(empty($type)) $type = 'data';
if(empty($module)) $module = ROUTE_M;
$filepath = CACHE_PATH.'caches_'.$module.'/caches_'.$type.'/';
$filename = $name.$this->_setting['suf'];
if (!file_exists($filepath.$filename)) {
return false;
} else {
if($this->_setting['type'] == 'array') {
$data = @require($filepath.$filename);</code>
最终$keyid变量变为$filename的一部分，造成本地文件包含漏洞的产生
由于文件get_linkage.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。
相关代码如下：
/api/ get_linkage.php
<pre class="prettyprint linenums">case 'ajax_select':
$parent_id = $_GET['parent_id'] ? intval($_GET['parent_id']) : 0;
$keyid = $_GET['keyid'];
ajax_select($parent_id,$keyid);
函数ajax_select在相同文件中有定义
function ajax_select($parentid,$keyid) {
$datas = getcache($keyid,'linkage');
$infos = $datas['data'];
$json_str = "[";
$json = array();
foreach($infos AS $k=>$v) {
if($v['parentid'] == $parentid) {
$r = array('region_id' => $v['linkageid'],
'region_name' => $v['name']);
$json[] = JSON($r);
}
}
$json_str .= implode(',',$json);
$json_str .= "]";
echo $json_str;
}</pre>
变量$keyid未经过滤进入到函数getcache中
Getcache函数在文件/ phpcms/libs/functions/ global.func.php中
<pre class="prettyprint linenums">function getcache($name, $filepath='', $type='file', $config='') {
pc_base::load_sys_class('cache_factory','',0);
if($config) {
$cacheconfig = pc_base::load_config('cache');
$cache = cache_factory::get_instance($cacheconfig)->get_cache($config);
} else {
$cache = cache_factory::get_instance()->get_cache($type);
}
return $cache->get($name, '', '', $filepath);
}
</pre>
$cache->get()在文件/phpcms/libs/classes/cache_file.class.php
<pre class="prettyprint linenums">public function get($name, $setting = '', $type = 'data', $module = ROUTE_M) {
$this->get_setting($setting);
if(empty($type)) $type = 'data';
if(empty($module)) $module = ROUTE_M;
$filepath = CACHE_PATH.'caches_'.$module.'/caches_'.$type.'/';
$filename = $name.$this->_setting['suf'];
if (!file_exists($filepath.$filename)) {
return false;
} else {
if($this->_setting['type'] == 'array') {
$data = @require($filepath.$filename);</pre>
最终$keyid变量变为$filename的一部分，造成本地文件包含漏洞的产生
PHPCMS V9.1.8 (20111014)
sebug 临时解决方案：
对变量$keyid做过滤
厂商补丁：
PHPCMS
-------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.phpcms.cn/
京公网安备 11010502034610号
暂无评论