| Название | RooCMS <= v1.4 Remote Code Execution |
|---|
| Описание | 1. Description
RooCMS uses eval() to execute PHP page and PHP Block content stored in the database. The application encodes user input via escape_string() before writing to the database, but during frontend rendering, $parse->text->html() restores all encodings before eval() execution. The HTML entity mappings of htmlspecialchars() / htmlspecialchars_decode() and str_ireplace() form perfect inverse pairs, providing no protection against eval() injection. An attacker with admin privileges can inject and execute arbitrary PHP code, achieving full server control.
2. Impact
(1) Arbitrary Code Execution: An attacker can execute arbitrary PHP functions such as system(), shell_exec(), exec(), passthru(), proc_open(), etc., to run OS commands with the web server user's privileges
(2) Full Server Control: Read/write arbitrary files, extract credentials from database configuration files, install persistent backdoors
(3) Persistent Backdoor: PHP code stored in the database is executed on every page visit, leaving no traces on the filesystem, making detection and forensics difficult |
|---|
| Источник | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/RooCMS-C1-EN.md |
|---|
| Пользователь | xwniscoming2002 (UID 99874) |
|---|
| Представление | 16.07.2026 16:14 (2 месяцы назад) |
|---|
| Модерация | 20.09.2026 12:28 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 408033 [RooCMS до 1.2.2/1.3.4/1.4RC2 Frontend Rendering roocms/site_pagePHP.php eval content эскалация привилегий] |
|---|
| Баллы | 20 |
|---|