W3 Total Cache < 0.9.5 – Authenticated Arbitrary PHP Code Execution

Description

This one is so mush easy to exploit using the import settings feature, this is what W3TC will do one your file is uploaded:
**********
/**
* Imports config content
*
* @param string $filename
* @return boolean
*/
function import($filename) {
if (file_exists($filename) && is_readable($filename)) {
$data = file_get_contents($filename);
if (substr($data, 0, 5) == '<?php')
$data = substr($data, 5);

$config = eval($data);

if (is_array($config)) {
foreach ($config as $key => $value)
$this->set($key, $value);

return true;
}
}

return false;
}
**********
The bad line is $config = eval($data); because it means that all my file content will be evaluated like any other PHP code. Basically we can send a PHP script that will create a backdoor.