Molyx Board 2.81 attachment. php is vulnerable to source code leakage due to lax page filtering.

Affected Versions:
Molyx Board 2.81

Vulnerability description:
MolyX Board is one of the Magic Series of Web application software products. MolyX Studios, after years of market technology research and research, based on the advantages of many Forum program technologies and practices, we have developed a forum system with powerful functions, fast speed, outstanding performance, and extremely high security for Chinese users. Built on PHP and MySql, the overall architecture adopts the most advanced object-oriented thinking, in terms of functions, speed, performance, security, development philosophy, and innovation consciousness, they all surpass similar products in the domestic and foreign markets. In just a few months, the magic forum has won unanimous praise and recognition from a large number of users and industry experts. More and more users have chosen the magic Forum as a solution for the Application website Forum community.

On the attachment. php page

1. function showthumb ()
2 .{
3. global $ DB, $ forums, $ _ INPUT, $ bbuserinfo, $ bboptions;
4. $ forums-> noheader = 1;
5 ................................
6. else
7 .{
8. $ subpath = SAFE_MODE? "": Implode (/, preg_split (//, intval ($ _ INPUT [u]),-1, PREG_SPLIT_NO_EMPTY ));
9. $ subpath = $ _ INPUT [attachpath]? $ _ INPUT [attachpath]: $ subpath;
10. $ path = $ bboptions [uploadfolder]./. $ subpath;
11. $ _ INPUT [attach] = str_replace ("\", "/", $ _ INPUT [attach]);
12. $ _ INPUT [attach] = str_replace ("/", "", substr ($ _ INPUT [attach], strrpos ($ _ INPUT [attach],/);
13. $ showfile = $ path. "/". $ _ INPUT [attach];
14 ......................................
15. if (file_exists ($ showfile) AND ($ forums-> cache [attachmenttype] [$ _ INPUT [extension] [mimetype]! = ""))
16 .{
17. @ header (Cache-control: max-age = 31536000 );
18. @ header (Expires:. gmdate ("D, d m y h: I: s", TIMENOW + 31536000). GMT );
19. @ header (Content-Type:. $ forums-> cache [attachmenttype] [$ _ INPUT [extension] [mimetype]);
20. @ header (Content-Disposition: inline; filename = ". urldecode ($ _ INPUT [filename]).");
21. @ header (Content-Transfer-Encoding: binary );
22. @ header (Content-Length:. (string) (filesize ($ showfile )));
23. @ readfile ($ showfile );
24. exit ();
25 .}
26 ....................................... ....

$ _ INPUT [attach] is strictly filtered, but $ _ INPUT [attachpath] is not filtered because stripslashes () is used during system initialization () so we can use % 00 to intercept the following parameters. <* Reference
Http://hi.baidu.com/mr_xhming
*>
Test method:

The Program (method) provided on this site may be offensive and only used for security research and teaching. You are at your own risk!
Post an attachment to the Forum and obtain it. Change the attachpath to any file.
Security suggestions:
Vendor patch:
MolyX Board
--------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
Http://www.molyx.com/