ZeroBox Vulnerability Database

由于文件get_linkage.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。
相关代码如下：
/api/ get_linkage.php

1. case ‘ajax_select’:
2. $parent_id = $_GET[‘parent_id’] ? intval($_GET[‘parent_id’]) : 0;
3. $keyid = $_GET[‘keyid’];
4. ajax_select($parent_id,$keyid);
5. 函数ajax_select在相同文件中有定义
6. function ajax_select($parentid,$keyid) {
7. $datas = getcache($keyid,’linkage’);
8. $infos = $datas[‘data’];
9. $json_str = “[“;
10. $json = array();
11. foreach($infos AS $k=>$v) {
12. if($v[‘parentid’] == $parentid) {
13. $r = array(‘region_id’ => $v[‘linkageid’],
14. ‘region_name’ => $v[‘name’]);
15. $json[] = JSON($r);
16. }
17. }
18. $json_str .= implode(‘,’,$json);
19. $json_str .= “]”;
20. echo $json_str;
21. }

变量$keyid未经过滤进入到函数getcache中
Getcache函数在文件/ phpcms/libs/functions/ global.func.php中

1. function getcache($name, $filepath=”, $type=’file’, $config=”) {
2. pc_base::load_sys_class(‘cache_factory’,”,0);
3. if($config) {
4. $cacheconfig = pc_base::load_config(‘cache’);
5. $cache = cache_factory::get_instance($cacheconfig)->get_cache($config);
6. } else {
7. $cache = cache_factory::get_instance()->get_cache($type);
8. }
9. return $cache->get($name, ”, ”, $filepath);
10. }

$cache->get()在文件/phpcms/libs/classes/cache_file.class.php

1. public function get($name, $setting = ”, $type = ‘data’, $module = ROUTE_M) {
2. $this->get_setting($setting);
3. if(empty($type)) $type = ‘data’;
4. if(empty($module)) $module = ROUTE_M;
5. $filepath = CACHE_PATH.’caches_’.$module.’/caches_’.$type.’/’;
6. $filename = $name.$this->_setting[‘suf’];
7. if (!file_exists($filepath.$filename)) {
8. return false;
9. } else {
10. if($this->_setting[‘type’] == ‘array’) {
11. $data = @require($filepath.$filename);