PHP Template Engine RCE via Incomplete Function Blacklist Filtering (application/admin/controller/Template.php)

Vulnerability Overview This vulnerability involves an issue with the loading of the function blacklist in a template engine. Specifically, it manifests as a modification to the assignment of the variable in the file. The modification adds more dangerous functions and characters, which may lead to code injection or the execution of malicious code. Impact Scope File Path: Affected Versions: From to Remediation Fix Commit: Fix Details: Additional dangerous functions and characters were added to the variable to enhance the filtering of potential malicious code. POC Code ```php $filter = '<?php eval($_server[\'assert\'][\'get\'][\'post\'][\'request\'][\'cookie\'][\'session\'][\'input\'][\'env\'][\'config\'][\'call\'][\'global\'][\'dump\'][\'print\'][\'phpinfo\'][\'fp\'][\'fopen\'][\'global\'][\'chr\'][\'str\'][\'pack\'][\'system\'][\'gzuncompress\'][\'shell\'][\'base64\'][\'file\'][\'proc\'][\'preg\'][\'call\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'ini\'][\'get\'][\'ini\'][\'restore\'][\'ini\'][\'set\'][\'

Goal Reached Thanks to every supporter — we hit 100%!

PHP Template Engine RCE via Incomplete Function Blacklist Filtering (application/admin/controller/Template.php)

More from this source