提出 #893004: RooCMS <= v1.4 Remote Code Execution

1. Description
RooCMS uses eval() to execute PHP page and PHP Block content stored in the database. The application encodes user input via escape_string() before writing to the database, but during frontend rendering, $parse->text->html() restores all encodings before eval() execution. The HTML entity mappings of htmlspecialchars() / htmlspecialchars_decode() and str_ireplace() form perfect inverse pairs, providing no protection against eval() injection. An attacker with admin privileges can inject and execute arbitrary PHP code, achieving full server control.
2. Impact
(1) Arbitrary Code Execution: An attacker can execute arbitrary PHP functions such as system(), shell_exec(), exec(), passthru(), proc_open(), etc., to run OS commands with the web server user's privileges
(2) Full Server Control: Read/write arbitrary files, extract credentials from database configuration files, install persistent backdoors
(3) Persistent Backdoor: PHP code stored in the database is executed on every page visit, leaving no traces on the filesystem, making detection and forensics difficult

• ソース: ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/RooCMS-C1-EN.md
• ユーザー: xwniscoming2002 (UID 99874)
• 送信: 2026年07月16日 16:14 (2 月 ago)
• モデレーション: 2026年09月20日 12:28 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 408033 [RooCMS 迄 1.2.2/1.3.4/1.4RC2 Frontend Rendering roocms/site_pagePHP.php eval content 特権昇格]
• ポイント: 20