W3 Total Cache, 752fc738-496f-44fd-9ca6-24e29ef8e75e

CVE, Research URL: 752fc738-496f-44fd-9ca6-24e29ef8e75e
Home page URL: Security reports for W3 Total Cache
Application: W3 Total Cache
Published on: -
Research Description: W3 Total Cache [w3-total-cache] < 0.9.5 W3 Total Cache <= 0.9.4.1 – Authenticated Arbitrary PHP Code Execution This one is so mush easy to exploit using the import settings feature, this is what W3TC will do one your file is uploaded: ********** /** * Imports config content * * @param string $filename * @return boolean */ function import($filename) { if (file_exists($filename) && is_readable($filename)) { $data = file_get_contents($filename); if (substr($data, 0, 5) == '<?php') $data = substr($data, 5); $config = eval($data); if (is_array($config)) { foreach ($config as $key => $value) $this->set($key, $value); return true; } } return false; } ********** The bad line is $config = eval($data); because it means that all my file content will be evaluated like any other PHP code. Basically we can send a PHP script that will create a backdoor.
Affected versions: max 0.9.5.
Status: vulnerable