0-day analysis of php-fusion

By Superhei @ ph4nt0m

Includes/update_profile_include.php

...
$ Newavatar = $ _ FILES [user_avatar];
If ($ userdata [user_avatar] = ""&&! Empty ($ newavatar [name]) & is_uploaded_file ($ newavatar [tmp_name]) {
If (preg_match ("/^ [-0-9A-Z _. [] + $/I", $ newavatar [name]) &
$ Newavatar [size] <= 30720 ){
$ Avatarext = strrchr ($ newavatar [name], ".");
If (eregi (". gif", $ avatarext) | eregi (". jpg", $ avatarext) |
Eregi (". png", $ avatarext )){
$ Avatarname = substr ($ newavatar [name], 0, strrpos ($ newavatar
[Name], ".");
$ Avatarname = $ avatarname. "[". $ userdata [user_id]. "]". $ avatarext;
$ Set_avatar = "user_avatar = $ avatarname ,";
Move_uploaded_file ($ newavatar [tmp_name], IMAGES. "avatars /".
$ Avatarname );
Chmod (IMAGES. "avatars/". $ avatarname, 0644 );
If ($ size = @ getimagesize (IMAGES. "avatars/". $ avatarname )){
If ($ size [0]> 100 | $ size [1]> 100 ){
Unlink (IMAGES. "avatars/". $ avatarname );
$ Set_avatar = "";
}
} Else {
Unlink (IMAGES. "avatars/". $ avatarname );
$ Set_avatar = "";

Pseudocode: <?
$ Newavatar [name] =$ _ GET [a]; // submit a4241.php.php.gif a print preg_match ("/^ [-0-9A-Z _. [] + $/I ", $ newavatar [name]); // The name can contain. $ avatarext = strrchr ($ newavatar [name], ". "); // print eregi (". gif ", $ avatarext); // you can submit the file only if the file is suffixed with. gif.

1.php.php.gif $ avatarname = substr ($ newavatar [name], 0, strrpos ($ newavatar [name], ". "); get the first part of the file name $ avatarname = $ avatarname. "[". $ userdata [user_id]. "]". $ avatarext; $ set_avatar = "user_avatar = $ avatarname,"; print $ avatarname; // 1.php.php.gif a ==> prepare a // convert ($ newavatar [tmp_name], IMAGES. "avatars /". $ avatarname );

[1] can be used in apache, so the following getimagesize () Judgment: if ($ size = @ getimagesize (IMAGES. "avatars/". $ avatarname )){
If ($ size [0]> 100 | $ size [1]> 100) {// you can use the post about paas getimagesize () to construct an image [2]

At that time, I tested v6.00.305 on the official website, but someone accidentally sent a message on milw0rm [3]. :(

So I went to the official site and found the new version v6.01.10 in a corner:

........
If ($ userdata [user_avatar] = ""&&! Empty ($ newavatar [name]) &
Is_uploaded_file ($ newavatar [tmp_name]) {
$ Avatarext = strrchr ($ newavatar [name], ".");
$ Avatarname = substr ($ newavatar [name], 0, strrpos ($ newavatar [name],
"."));
If (preg_match ("/^ [-0-9A-Z _ [] + $/I", $ avatarname) & preg_match ("/
(.Gif |. GIF |. jpg |. JPG |. png |. PNG)

$/", $ Avatarext) & $ newavatar [size] <= 30720 ){
$ Avatarname = $ avatarname. "[". $ userdata [user_id]. "]". $ avatarext;
$ Set_avatar = "user_avatar = $ avatarname ,";
Move_uploaded_file ($ newavatar [tmp_name], IMAGES. "avatars /".
$ Avatarname );
Chmod (IMAGES. "avatars/". $ avatarname, 0644 );
If ($ size = @ getimagesize (IMAGES. "avatars/". $ avatarname )){
If ($ size [0]> 100 | $ size [1]> 100 ){
Unlink (IMAGES. "avatars/". $ avatarname );

........

Pseudocode for judgment:

<?
$ Newavatar [name] =_ _ GET [a];
$ Avatarext = strrchr ($ newavatar [name], ".");
$ Avatarname = substr ($ newavatar [name], 0, strrpos ($ newavatar [name], ".");
Print $ avatarext. "<br> ";
Print $ avatarname. "<br> ";
Print preg_match ("/^ [-0-9A-Z _ [] + $/I", $ avatarname). "<br>"; // do not extract the suffix
It can be a type such as. example. php.gif.]
Print preg_match ("/(.gif |. GIF |. jpg |. JPG |. png |. PNG) $/", $ avatarext). "<br> ";

No ~~~

Some sy thoughts:
If

Preg_match ("/^ [-0-9A-Z _ [] + $/I", $ avatarname)

If there is no filter, is there a chance? Code:

<?
$ Newavatar [name] =_ _ GET [a];
$ Avatarext = strrchr ($ newavatar [name], ".");
$ Avatarname = substr ($ newavatar [name], 0, strrpos ($ newavatar [name], ".");
Print $ avatarext. "<br> ";
Print $ avatarname. "<br> ";
Print preg_match (""/^ [-0-9A-Z _. [] + $/I "", $ avatarname). "<br>"; // we use
V6.00.305 regular expression.
Print preg_match ("/(.gif |. GIF |. jpg |. JPG |. png |. PNG) $/", $ avatarext). "<br> ";

We submit? A00001.php.php.gif

Preg_match (""/^ [-0-9A-Z _. [] + $/I "", $ avatarname) ==> 1
Preg_match ("/(.gif |. GIF |. jpg |. JPG |. png |. PNG) $/", $ avatarext) ==> 0

Failed, but if you have read the blog [4],

Preg_match ("/(.gif |. GIF |. jpg |. JPG |. png |. PNG) $/", $ avatarext)

This is still possible:
Submit? A00001.php.php.gif % 0a can be bypassed,

Move_uploaded_file ($ newavatar [tmp_name], IMAGES. "avatars/". $ avatarname );

The file name 1.php.php.gif x0a in winis invalid, but it can be used in * nix :).