提交 #893004: RooCMS <= v1.4 Remote Code Execution

1. Description
RooCMS uses eval() to execute PHP page and PHP Block content stored in the database. The application encodes user input via escape_string() before writing to the database, but during frontend rendering, $parse->text->html() restores all encodings before eval() execution. The HTML entity mappings of htmlspecialchars() / htmlspecialchars_decode() and str_ireplace() form perfect inverse pairs, providing no protection against eval() injection. An attacker with admin privileges can inject and execute arbitrary PHP code, achieving full server control.
2. Impact
(1) Arbitrary Code Execution: An attacker can execute arbitrary PHP functions such as system(), shell_exec(), exec(), passthru(), proc_open(), etc., to run OS commands with the web server user's privileges
(2) Full Server Control: Read/write arbitrary files, extract credentials from database configuration files, install persistent backdoors
(3) Persistent Backdoor: PHP code stored in the database is executed on every page visit, leaving no traces on the filesystem, making detection and forensics difficult

• 来源: ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/RooCMS-C1-EN.md
• 用户: xwniscoming2002 (UID 99874)
• 提交: 2026-07-16 16時14分 (2 月前)
• 管理: 2026-09-20 12時28分 (2 months later)
• 状态: 已接受
• VulDB条目: 408033 [RooCMS 直到 1.2.2/1.3.4/1.4RC2 Frontend Rendering roocms/site_pagePHP.php eval content 权限提升]
• 积分: 20