CVE-2015-5243: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2018-08-20T21:29Z
Repository: https://github.com/Gemorroj/phpwhois
Language: PHP
Files changed: src/whois.parser.php
Commit date: 2018-02-10 20:40:14 +0300
Commit message: remove eval-s

Diff: diff --git a/src/whois.parser.php b/src/whois.parser.php
index 7258919..a19a1df 100644
--- a/src/whois.parser.php
+++ b/src/whois.parser.php
@@ -100,14 +100,16 @@ function generic_parser_a_blocks($rawdata, $translate, &$disclaimer)
 
         if (isset($translate[$k])) {
             $k = $translate[$k];
             if ($k == '') continue;
             if (strstr($k, '.')) {
-                eval("\$block" . getvarname($k) . "=\$v;");
+                ${'block' . getvarname($k)} = $v;
                 continue;
             }
-        } else $k = strtolower($k);
+        } else {
+            $k = strtolower($k);
+        }
 
         if ($k == 'handle') {
             $v = strtok($v, ' ');
             $gkey = strtoupper($v);
         }
@@ -343,19 +345,20 @@ function generic_parser_b($rawdata, $items = false, $dateformat = 'mdy', $hasreg
             foreach ($items as $match => $field) {
                 $pos = strpos($val, $match);
 
                 if ($pos !== false) {
                     if ($field != '') {
-                        $var = '$r' . getvarname($field);
                         $itm = trim(substr($val, $pos + strlen($match)));
 
-                        if ($itm != '')
-                            eval($var . '="' . str_replace('"', '\"', $itm) . '";');
+                        if ($itm != '') {
+                            ${'r' . getvarname($field)} = '="' . str_replace('"', '\"', $itm) . '";';
+                        }
                     }
 
-                    if (!$scanall)
+                    if (!$scanall) {
                         break;
+                    }
                 }
             }
         }
     }
 
@@ -416,11 +419,12 @@ function get_blocks($rawdata, $items, $partial_match = false, $def_block = false
                     $endtag = $last;
                     $line = $val;
                 } else {
                     $var = getvarname(strtok($field, '#'));
                     $itm = trim(substr($val, $pos + strlen($match)));
-                    eval('$r' . $var . '=$itm;');
+
+                    ${'r' . $var} = $itm;
                 }
 
                 break;
             }
         }
@@ -478,11 +482,13 @@ function get_blocks($rawdata, $items, $partial_match = false, $def_block = false
         foreach ($items as $field => $match) {
             $pos = strpos($line, $match);
 
             if ($pos !== false) {
                 $var = getvarname(strtok($field, '#'));
-                if ($var != '[]') eval('$r' . $var . '=$block;');
+                if ($var != '[]') {
+                    ${'r' . $var} = $block;
+                }
             }
         }
     }
 
     return $r;
@@ -584,11 +590,11 @@ function get_contact($array, $extra_items = '', $has_org = false)
                 if ($pos === false) continue;
 
                 $itm = trim(substr($val, $pos + strlen($match)));
 
                 if ($field != '' && $itm != '') {
-                    eval('$r' . getvarname($field) . '=$itm;');
+                    ${'r' . getvarname($field)} = $itm;
                 }
 
                 $val = trim(substr($val, 0, $pos));
 
                 if ($val == '') {

Vulnerable code:                 eval("\$block" . getvarname($k) . "=\$v;");
        } else $k = strtolower($k);
                        $var = '$r' . getvarname($field);
                        if ($itm != '')
                            eval($var . '="' . str_replace('"', '\"', $itm) . '";');
                    if (!$scanall)
                    eval('$r' . $var . '=$itm;');
                if ($var != '[]') eval('$r' . $var . '=$block;');
                    eval('$r' . getvarname($field) . '=$itm;');
Fixed code:                 ${'block' . getvarname($k)} = $v;
        } else {
            $k = strtolower($k);
        }
                        if ($itm != '') {
                            ${'r' . getvarname($field)} = '="' . str_replace('"', '\"', $itm) . '";';
                        }
                    if (!$scanall) {
                    }

                    ${'r' . $var} = $itm;
                if ($var != '[]') {
                    ${'r' . $var} = $block;
                }
                    ${'r' . getvarname($field)} = $itm;