Arbitrary boblog variable Overwrite Vulnerability Analysis (trigger method 3)

Previously, 80vul.com published a bo-blog vulnerability [1], which has been officially fixed, but then wooyun.com published a method for bypassing the Patch [2], unfortunately, there are some restrictions for triggering. Next I will announce a method to continue to trigger the vulnerability without any restrictions by bypassing the patch :)

This is simply because regular expressions and code logic are not rigorous. Let's look at the Code:

// Go. php

$ Q_url = $ _ SERVER ["REQUEST_URI"];
@ List ($ relativePath, $ rawURL) = @ explode (/go. php/, $ q_url );
$ RewritedURL = $ rawURL;
...
$ RewriteRules [] = "/page/([0-9] +)/([0-9] + )/? /";
// This regular expression looks very rigorous, but it does not use ^ and $ to limit the beginning and end [it may be to adapt to the needs of the program] :)
...
$ RedirectTo [] = "index. php? Mode = \ 1 & page = \ 2 ";
...
Foreach ($ RewriteRules as $ rule ){
If (preg_match ($ rule, $ rewritedURL )){
$ Tmp_rewritedURL = preg_replace ($ rule, <. $ RedirectTo [$ I]. <, $ rewritedURL, 1 );
// Match and replace $ rewritedURL, and use <to mark the matched part
// After such processing, $ tmp_rewritedURL is divided into three parts:
// I. First <previous part
// Ii. Part between two <
// Iii. The second part <
$ Tmp_rewritedURL = @ explode (<, $ tmp_rewritedURL );
$ RewritedURL = ($ tmp_rewritedURL [2])? False: $ tmp_rewritedURL [1];
// The main purpose of this Code is to solve the problem that the regular expression restrictions are not strict enough.
// The programmer wants to remove I and iii through this code so that $ rewritedURL only retains ii
// Note that restrictions on iii are also imposed here. According to the programmer's idea, this part of iii should not exist :)
// The Key to this part of the code logic is <this character, but unfortunately we can inject it at will <: p
Break;
}
$ I + = 1;
}
From the above analysis, we can see that this code looks very rigorous for the $ rewritedURL processing logic, but in fact we only need to simply inject <this character, we can disrupt the entire logic :)

Refer:
[1] html "> http://www.bkjia.com/Article/201102/84406.html

[2] http://www.wooyun.org/bugs/wooyun-2010-01491