XoopsModules25x /
xoopsinfo
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 23 | * @version Release: 3.0 |
||
| 24 | * @link http://phpsysinfo.sourceforge.net |
||
| 25 | */ |
||
| 26 | class CommonFunctions |
||
|
|
|||
| 27 | { |
||
| 28 | private static function _parse_log_file($string) |
||
| 29 | { |
||
| 31 | $log_file = substr(PSI_LOG, 1); |
||
| 32 | if (file_exists($log_file)) { |
||
| 33 | $contents = @file_get_contents($log_file); |
||
| 34 | View Code Duplication | if ($contents && preg_match("/^\-\-\-[^-\r\n]+\-\-\- ".preg_quote($string, '/')."\r?\n/m", $contents, $matches, PREG_OFFSET_CAPTURE)) { |
|
| 35 | $findIndex = $matches[0][1]; |
||
| 36 | if (preg_match("/\r?\n/m", $contents, $matches, PREG_OFFSET_CAPTURE, $findIndex)) { |
||
| 37 | $startIndex = $matches[0][1]+1; |
||
| 56 | * |
||
| 57 | * @param string $strProgram name of the program |
||
| 58 | * |
||
| 59 | * @return string complete path and name of the program |
||
| 60 | */ |
||
| 61 | private static function _findProgram($strProgram) |
||
| 62 | { |
||
| 70 | $path_parts = pathinfo($strProgram); |
||
| 71 | } |
||
| 72 | if (empty($path_parts['dirname']) || ($path_parts['dirname'] == '.')) { |
||
| 73 | View Code Duplication | if (PSI_OS == 'WINNT') { |
|
| 74 | $arrPath = preg_split('/;/', getenv("Path"), -1, PREG_SPLIT_NO_EMPTY); |
||
| 75 | } else { |
||
| 76 | $arrPath = preg_split('/:/', getenv("PATH"), -1, PREG_SPLIT_NO_EMPTY); |
||
| 77 | } |
||
| 78 | if (defined('PSI_ADD_PATHS') && is_string(PSI_ADD_PATHS)) { |
||
| 79 | if (preg_match(ARRAY_EXP, PSI_ADD_PATHS)) { |
||
| 80 | $arrPath = array_merge(eval(PSI_ADD_PATHS), $arrPath); // In this order so $addpaths is before $arrPath when looking for a program |
||
| 81 | } else { |
||
| 82 | $arrPath = array_merge(array(PSI_ADD_PATHS), $arrPath); // In this order so $addpaths is before $arrPath when looking for a program |
||
| 83 | } |
||
| 111 | } |
||
| 112 | |||
| 113 | // If open_basedir defined, fill the $open_basedir array with authorized paths,. (Not tested when no open_basedir restriction) |
||
| 114 | View Code Duplication | if ((bool) ini_get('open_basedir')) { |
|
| 115 | if (PSI_OS == 'WINNT') { |
||
| 116 | $open_basedir = preg_split('/;/', ini_get('open_basedir'), -1, PREG_SPLIT_NO_EMPTY); |
||
| 117 | } else { |
||
| 120 | } |
||
| 121 | foreach ($arrPath as $strPath) { |
||
| 122 | // Path with trailing slash |
||
| 123 | View Code Duplication | if (PSI_OS == 'WINNT') { |
|
| 124 | $strPathS = rtrim($strPath, "\\")."\\"; |
||
| 125 | } else { |
||
| 126 | $strPathS = rtrim($strPath, "/")."/"; |
||
| 129 | if (isset($open_basedir)) { |
||
| 130 | $inBaseDir = false; |
||
| 131 | if (PSI_OS == 'WINNT') { |
||
| 132 | View Code Duplication | foreach ($open_basedir as $openbasedir) { |
|
| 133 | if (substr($openbasedir, -1)=="\\") { |
||
| 134 | $str_Path = $strPathS; |
||
| 135 | } else { |
||
| 141 | } |
||
| 142 | } |
||
| 143 | } else { |
||
| 144 | View Code Duplication | foreach ($open_basedir as $openbasedir) { |
|
| 145 | if (substr($openbasedir, -1)=="/") { |
||
| 146 | $str_Path = $strPathS; |
||
| 147 | } else { |
||
| 153 | } |
||
| 154 | } |
||
| 155 | } |
||
| 156 | if ($inBaseDir == false) { |
||
| 157 | continue; |
||
| 158 | } |
||
| 159 | } |
||
| 160 | if (($strPath !== $exceptPath) && !is_dir($strPath)) { |
||
| 161 | continue; |
||
| 162 | } |
||
| 163 | View Code Duplication | if (PSI_OS == 'WINNT') { |
|
| 164 | $strProgrammpath = rtrim($strPath, "\\")."\\".$strProgram; |
||
| 165 | } else { |
||
| 166 | $strProgrammpath = rtrim($strPath, "/")."/".$strProgram; |
||
| 184 | * |
||
| 185 | * @return boolean command successfull or not |
||
| 186 | */ |
||
| 187 | public static function executeProgram($strProgramname, $strArgs, &$strBuffer, $booErrorRep = true) |
||
| 188 | { |
||
| 189 | View Code Duplication | if (defined('PSI_LOG') && is_string(PSI_LOG) && (strlen(PSI_LOG)>0) && ((substr(PSI_LOG, 0, 1)=="-") || (substr(PSI_LOG, 0, 1)=="+"))) { |
|
| 190 | $out = self::_parse_log_file("Executing: ".trim($strProgramname.' '.$strArgs)); |
||
| 191 | if ($out == false) { |
||
| 192 | if (substr(PSI_LOG, 0, 1)=="-") { |
||
| 193 | $strBuffer = ''; |
||
| 194 | |||
| 205 | $strError = ''; |
||
| 206 | $pipes = array(); |
||
| 207 | $strProgram = self::_findProgram($strProgramname); |
||
| 208 | $error = PSI_Error::singleton(); |
||
| 209 | if (!$strProgram) { |
||
| 210 | if ($booErrorRep) { |
||
| 211 | $error->addError('find_program('.$strProgramname.')', 'program not found on the machine'); |
||
| 212 | } |
||
| 213 | |||
| 214 | return false; |
||
| 248 | } |
||
| 249 | } else { |
||
| 250 | if ($booErrorRep) { |
||
| 251 | $error->addError($strProgram, "\nOpen process error"); |
||
| 252 | } |
||
| 253 | |||
| 254 | return false; |
||
| 260 | } |
||
| 261 | if (! empty($strError)) { |
||
| 262 | if ($booErrorRep) { |
||
| 263 | $error->addError($strProgram, $strError."\nReturn value: ".$return_value); |
||
| 264 | } |
||
| 265 | |||
| 266 | return $return_value == 0; |
||
| 280 | * |
||
| 281 | * @return boolean command successfull or not |
||
| 282 | */ |
||
| 283 | public static function rfts($strFileName, &$strRet, $intLines = 0, $intBytes = 4096, $booErrorRep = true) |
||
| 284 | { |
||
| 285 | View Code Duplication | if (defined('PSI_LOG') && is_string(PSI_LOG) && (strlen(PSI_LOG)>0) && ((substr(PSI_LOG, 0, 1)=="-") || (substr(PSI_LOG, 0, 1)=="+"))) { |
|
| 286 | $out = self::_parse_log_file("Reading: ".$strFileName); |
||
| 287 | if ($out == false) { |
||
| 288 | if (substr(PSI_LOG, 0, 1)=="-") { |
||
| 289 | $strRet = ''; |
||
| 290 | |||
| 299 | |||
| 300 | $strFile = ""; |
||
| 301 | $intCurLine = 1; |
||
| 302 | $error = PSI_Error::singleton(); |
||
| 303 | if (file_exists($strFileName)) { |
||
| 304 | if (is_readable($strFileName)) { |
||
| 305 | if ($fd = fopen($strFileName, 'r')) { |
||
| 322 | } |
||
| 323 | } else { |
||
| 324 | if ($booErrorRep) { |
||
| 325 | $error->addError('fopen('.$strFileName.')', 'file can not read by phpsysinfo'); |
||
| 326 | } |
||
| 327 | |||
| 328 | return false; |
||
| 329 | } |
||
| 330 | } else { |
||
| 331 | if ($booErrorRep) { |
||
| 332 | $error->addError('fopen('.$strFileName.')', 'file permission error'); |
||
| 333 | } |
||
| 334 | |||
| 335 | return false; |
||
| 336 | } |
||
| 337 | } else { |
||
| 338 | if ($booErrorRep) { |
||
| 339 | $error->addError('file_exists('.$strFileName.')', 'the file does not exist on your machine'); |
||
| 340 | } |
||
| 341 | |||
| 342 | return false; |
||
| 381 | public static function gdc($strPath, $booErrorRep = true) |
||
| 382 | { |
||
| 383 | $arrDirectoryContent = array(); |
||
| 384 | $error = PSI_Error::singleton(); |
||
| 385 | if (is_dir($strPath)) { |
||
| 386 | if ($handle = opendir($strPath)) { |
||
| 387 | while (($strFile = readdir($handle)) !== false) { |
||
| 392 | closedir($handle); |
||
| 393 | } else { |
||
| 394 | if ($booErrorRep) { |
||
| 395 | $error->addError('opendir('.$strPath.')', 'directory can not be read by phpsysinfo'); |
||
| 396 | } |
||
| 397 | } |
||
| 398 | } else { |
||
| 399 | if ($booErrorRep) { |
||
| 400 | $error->addError('is_dir('.$strPath.')', 'directory does not exist on your machine'); |
||
| 401 | } |
||
| 402 | } |
||
| 403 | |||
| 443 | if ($error) { |
||
| 444 | header("Content-Type: text/xml\n\n"); |
||
| 445 | echo $text; |
||
| 446 | die(); |
||
| 447 | } |
||
| 448 | } |
||
| 449 | |||
| 508 | { |
||
| 509 | $arrData = array(); |
||
| 510 | if ($wmi) { |
||
| 511 | $value = ""; |
||
| 512 | try { |
||
| 513 | $objWEBM = $wmi->Get($strClass); |
||
| 514 | $arrProp = $objWEBM->Properties_; |
||
| 519 | } |
||
| 520 | $arrInstance = array(); |
||
| 521 | foreach ($arrProp as $propItem) { |
||
| 522 | $value = $objItem->{$propItem->Name}; //instead exploitable eval("\$value = \$objItem->".$propItem->Name.";"); |
||
| 523 | if (empty($strValue)) { |
||
| 524 | View Code Duplication | if (is_string($value)) $arrInstance[$propItem->Name] = trim($value); |
|
| 525 | else $arrInstance[$propItem->Name] = $value; |
||
| 526 | View Code Duplication | } else { |
|
| 527 | if (in_array($propItem->Name, $strValue)) { |
||
| 528 | if (is_string($value)) $arrInstance[$propItem->Name] = trim($value); |
||
| 529 | else $arrInstance[$propItem->Name] = $value; |
||
| 534 | } |
||
| 535 | } catch (Exception $e) { |
||
| 536 | if (PSI_DEBUG) { |
||
| 537 | $error = PSI_Error::singleton(); |
||
| 538 | $error->addError($e->getCode(), $e->getMessage()); |
||
| 539 | } |
||
| 540 | } |
||
| 541 | } |
||
| 552 | { |
||
| 553 | if (defined('PSI_PLUGINS') && is_string(PSI_PLUGINS)) { |
||
| 554 | if (preg_match(ARRAY_EXP, PSI_PLUGINS)) { |
||
| 555 | return eval(strtolower(PSI_PLUGINS)); |
||
| 556 | } else { |
||
| 557 | return array(strtolower(PSI_PLUGINS)); |
||
| 558 | } |
||
| 564 |
mambax7
Loading history...
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.