| 제목 | RooCMS <= v1.4 Remote Code Execution |
|---|
| 설명 | 1. Description
RooCMS uses eval() to execute PHP page and PHP Block content stored in the database. The application encodes user input via escape_string() before writing to the database, but during frontend rendering, $parse->text->html() restores all encodings before eval() execution. The HTML entity mappings of htmlspecialchars() / htmlspecialchars_decode() and str_ireplace() form perfect inverse pairs, providing no protection against eval() injection. An attacker with admin privileges can inject and execute arbitrary PHP code, achieving full server control.
2. Impact
(1) Arbitrary Code Execution: An attacker can execute arbitrary PHP functions such as system(), shell_exec(), exec(), passthru(), proc_open(), etc., to run OS commands with the web server user's privileges
(2) Full Server Control: Read/write arbitrary files, extract credentials from database configuration files, install persistent backdoors
(3) Persistent Backdoor: PHP code stored in the database is executed on every page visit, leaving no traces on the filesystem, making detection and forensics difficult |
|---|
| 원천 | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/RooCMS-C1-EN.md |
|---|
| 사용자 | xwniscoming2002 (UID 99874) |
|---|
| 제출 | 2026. 07. 16. PM 04:14 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 20. PM 12:28 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 408033 [RooCMS 까지 1.2.2/1.3.4/1.4RC2 Frontend Rendering roocms/site_pagePHP.php eval content 권한 상승] |
|---|
| 포인트들 | 20 |
|---|