微窗cms最新版任意代码执行漏洞分析

function string2array($data) {
    if(is_array($data)) return $data;
    if($data == '') return array();
    if(!strexists(strtolower($data), 'array')) return array();
    @ini_set('display_errors', 'on');
    @eval("\$array = $data;");
    @ini_set('display_errors', 'off');
    $array = isset($array)?$array:array();
    return is_array($array)?$array:array();
}

public function doWebeditval()
   {
       $arr = array();
       $arr['success'] = 0;
       $arr['val'] = '';
       if ($this->input->post("dosubmit")){
           //
           $id = intval($this->input->post('id'));
           $type = $this->input->post('type');
           $isnum = $this->input->post('isnum');
           $val = $this->input->post('val');
           if ($isnum == 'yes') {
               $val = intval($val);
           }
           $row = $this->ddb->getone("SELECT * FROM ".table('vip_content'), $this->merge(array('id'=>$id)));
           if (empty($row)) {
               $arr['message'] = '内容不存在';
               echo json_encode($arr); exit();
           }
           if (!isset($row[$type])){
               $arr['message'] = '参数错误';
               echo json_encode($arr); exit();
           }
           if ($this->ddb->update(table('vip_content'), array($type=>$val), array('id'=>$id))){
               $arr['success'] = 1;
               $arr['message'] = '修改成功';
               $arr['val'] = $val;
           }else{
               $arr['message'] = '修改失败';
           }
           echo json_encode($arr); exit();
       }else{
           $arr['message'] = '非法操作';
           echo json_encode($arr); exit();
       }
   }

public function doWebprivilegerelease()
  {
      global $_A,$_GPC;
      $ufrow = $this->ddb->getone("SELECT userdata FROM ".table("users_functions"), array('id'=>$_A['uf']['id']));
      $userdata = string2array($ufrow['userdata']);
      $id = intval($_GPC['param'][2]);
      $row = array();
      $subtitle = "发布";
      if ($id > 0){
          $row = $this->ddb->getone("SELECT * FROM ".table("vip_content"), $this->merge(array('type'=>'vip', 'id'=>intval($id))));
          if (!empty($row)){
              $row['startdate'] = date('Y-m-d', $row['startdate']);
              $row['enddate'] = date('Y-m-d', $row['enddate']);
              $row['setting'] = string2array($row['setting']);
              $subtitle = "修改";
          }else{
              $id = 0;
          }
      }