Vulnerability: phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Vulnerability ID: CVE-2015-5243
CWE: CWE-94
Severity score: 6.4
Project: https://github.com/Gemorroj/phpwhois
Published: 2018-08-20
File: src/whois.parser.php
Commit message: remove eval-s
Commit author: Gemorroj

Vulnerable version (before fix):
 function generic_parser_a_blocks($rawdata, $translate, &$disclaimer)             $k = $translate[$k];             if ($k == '') continue;             if (strstr($k, '.')) {                 eval("\$block" . getvarname($k) . "=\$v;");                 continue;             }         } else $k = strtolower($k);          if ($k == 'handle') {             $v = strtok($v, ' '); function generic_parser_b($rawdata, $items = false, $dateformat = 'mdy', $hasreg                  if ($pos !== false) {                     if ($field != '') {                         $var = '$r' . getvarname($field);                         $itm = trim(substr($val, $pos + strlen($match)));                          if ($itm != '')                             eval($var . '="' . str_replace('"', '\"', $itm) . '";');                     }                      if (!$scanall)                         break;                 }             }         } function get_blocks($rawdata, $items, $partial_match = false, $def_block = false                 } else {                     $var = getvarname(strtok($field, '#'));                     $itm = trim(substr($val, $pos + strlen($match)));                     eval('$r' . $var . '=$itm;');                 }                  break; function get_blocks($rawdata, $items, $partial_match = false, $def_block = false              if ($pos !== false) {                 $var = getvarname(strtok($field, '#'));                 if ($var != '[]') eval('$r' . $var . '=$block;');             }         }     } function get_contact($array, $extra_items = '', $has_org = false)                 $itm = trim(substr($val, $pos + strlen($match)));                  if ($field != '' && $itm != '') {                     eval('$r' . getvarname($field) . '=$itm;');                 }                  $val = trim(substr($val, 0, $pos));

Fixed version (after fix):
 function generic_parser_a_blocks($rawdata, $translate, &$disclaimer)             $k = $translate[$k];             if ($k == '') continue;             if (strstr($k, '.')) {                 ${'block' . getvarname($k)} = $v;                 continue;             }         } else {             $k = strtolower($k);         }          if ($k == 'handle') {             $v = strtok($v, ' '); function generic_parser_b($rawdata, $items = false, $dateformat = 'mdy', $hasreg                  if ($pos !== false) {                     if ($field != '') {                         $itm = trim(substr($val, $pos + strlen($match)));                          if ($itm != '') {                             ${'r' . getvarname($field)} = '="' . str_replace('"', '\"', $itm) . '";';                         }                     }                      if (!$scanall) {                         break;                     }                 }             }         } function get_blocks($rawdata, $items, $partial_match = false, $def_block = false                 } else {                     $var = getvarname(strtok($field, '#'));                     $itm = trim(substr($val, $pos + strlen($match)));                      ${'r' . $var} = $itm;                 }                  break; function get_blocks($rawdata, $items, $partial_match = false, $def_block = false              if ($pos !== false) {                 $var = getvarname(strtok($field, '#'));                 if ($var != '[]') {                     ${'r' . $var} = $block;                 }             }         }     } function get_contact($array, $extra_items = '', $has_org = false)                 $itm = trim(substr($val, $pos + strlen($match)));                  if ($field != '' && $itm != '') {                     ${'r' . getvarname($field)} = $itm;                 }                  $val = trim(substr($val, 0, $pos));

Patch:
patch: @@ -102,10 +102,12 @@ function generic_parser_a_blocks($rawdata, $translate, &$disclaimer)
             $k = $translate[$k];
             if ($k == '') continue;
             if (strstr($k, '.')) {
-                eval("\$block" . getvarname($k) . "=\$v;");
+                ${'block' . getvarname($k)} = $v;
                 continue;
             }
-        } else $k = strtolower($k);
+        } else {
+            $k = strtolower($k);
+        }
 
         if ($k == 'handle') {
             $v = strtok($v, ' ');
@@ -345,15 +347,16 @@ function generic_parser_b($rawdata, $items = false, $dateformat = 'mdy', $hasreg
 
                 if ($pos !== false) {
                     if ($field != '') {
-                        $var = '$r' . getvarname($field);
                         $itm = trim(substr($val, $pos + strlen($match)));
 
-                        if ($itm != '')
-                            eval($var . '="' . str_replace('"', '\"', $itm) . '";');
+                        if ($itm != '') {
+                            ${'r' . getvarname($field)} = '="' . str_replace('"', '\"', $itm) . '";';
+                        }
                     }
 
-                    if (!$scanall)
+                    if (!$scanall) {
                         break;
+                    }
                 }
             }
         }
@@ -418,7 +421,8 @@ function get_blocks($rawdata, $items, $partial_match = false, $def_block = false
                 } else {
                     $var = getvarname(strtok($field, '#'));
                     $itm = trim(substr($val, $pos + strlen($match)));
-                    eval('$r' . $var . '=$itm;');
+
+                    ${'r' . $var} = $itm;
                 }
 
                 break;
@@ -480,7 +484,9 @@ function get_blocks($rawdata, $items, $partial_match = false, $def_block = false
 
             if ($pos !== false) {
                 $var = getvarname(strtok($field, '#'));
-                if ($var != '[]') eval('$r' . $var . '=$block;');
+                if ($var != '[]') {
+                    ${'r' . $var} = $block;
+                }
             }
         }
     }
@@ -586,7 +592,7 @@ function get_contact($array, $extra_items = '', $has_org = false)
                 $itm = trim(substr($val, $pos + strlen($match)));
 
                 if ($field != '' && $itm != '') {
-                    eval('$r' . getvarname($field) . '=$itm;');
+                    ${'r' . getvarname($field)} = $itm;
                 }
 
                 $val = trim(substr($val, 0, $pos));
path: src/whois.parser.php