Mybb 18.20 From Stored XSS to RCE 分析
function parse_mycode($message, $options=array()){global $lang, $mybb;if(empty($this->options)){$th 2019-06-12 18:48:04 Author: lorexxar.cn(查看原文) 阅读量:486 收藏

function parse_mycode($message, $options=array())

{

global $lang, $mybb;

if(empty($this->options))

{

$this->options = $options;

}

if($this->mycode_cache == 0)

{

$this->cache_mycode();

}

$message = $this->mycode_parse_quotes($message);

if(!empty($this->options['allow_imgcode']))

{

$message = preg_replace_callback("#\[img\](\r\n?|\n?)(https?://([^<>\"']+?))\[/img\]#is", array($this, 'mycode_parse_img_callback1'), $message);

$message = preg_replace_callback("#\[img=([1-9][0-9]*)x([1-9][0-9]*)\](\r\n?|\n?)(https?://([^<>\"']+?))\[/img\]#is", array($this, 'mycode_parse_img_callback2'), $message);

$message = preg_replace_callback("#\[img align=(left|right)\](\r\n?|\n?)(https?://([^<>\"']+?))\[/img\]#is", array($this, 'mycode_parse_img_callback3'), $message);

$message = preg_replace_callback("#\[img=([1-9][0-9]*)x([1-9][0-9]*) align=(left|right)\](\r\n?|\n?)(https?://([^<>\"']+?))\[/img\]#is", array($this, 'mycode_parse_img_callback4'), $message);

}

else

{

$message = preg_replace_callback("#\[img\](\r\n?|\n?)(https?://([^<>\"']+?))\[/img\]#is", array($this, 'mycode_parse_img_disabled_callback1'), $message);

$message = preg_replace_callback("#\[img=([1-9][0-9]*)x([1-9][0-9]*)\](\r\n?|\n?)(https?://([^<>\"']+?))\[/img\]#is", array($this, 'mycode_parse_img_disabled_callback2'), $message);

$message = preg_replace_callback("#\[img align=(left|right)\](\r\n?|\n?)(https?://([^<>\"']+?))\[/img\]#is", array($this, 'mycode_parse_img_disabled_callback3'), $message);

$message = preg_replace_callback("#\[img=([1-9][0-9]*)x([1-9][0-9]*) align=(left|right)\](\r\n?|\n?)(https?://([^<>\"']+?))\[/img\]#is", array($this, 'mycode_parse_img_disabled_callback4'), $message);

}

if(!empty($this->options['allow_videocode']))

{

$message = preg_replace_callback("#\[video=(.*?)\](.*?)\[/video\]#i", array($this, 'mycode_parse_video_callback'), $message);

}

else

{

$message = preg_replace_callback("#\[video=(.*?)\](.*?)\[/video\]#i", array($this, 'mycode_parse_video_disabled_callback'), $message);

}

$message = str_replace('$', '&#36;', $message);

if($this->mycode_cache['standard_count'] > 0)

{

$message = preg_replace($this->mycode_cache['standard']['find'], $this->mycode_cache['standard']['replacement'], $message);

}

if($this->mycode_cache['callback_count'] > 0)

{

foreach($this->mycode_cache['callback'] as $replace)

{

$message = preg_replace_callback($replace['find'], $replace['replacement'], $message);

}

}

if($this->mycode_cache['nestable_count'] > 0)

{

foreach($this->mycode_cache['nestable'] as $mycode)

{

while(preg_match($mycode['find'], $message))

{

$message = preg_replace($mycode['find'], $mycode['replacement'], $message);

}

}

}

if($mybb->settings['allowlistmycode'] == 1)

{

$this->list_elements = array();

$this->list_count = 0;

$message = preg_replace_callback("#(\[list(=(a|A|i|I|1))?\]|\[/list\])#si", array($this, 'mycode_prepare_list'), $message);

for($i = $this->list_count; $i > 0; $i--)

{

$message = preg_replace_callback("#\s?\[list(=(a|A|i|I|1))?&{$i}\](.*?)(\[/list&{$i}\]|$)(\r\n?|\n?)#si", array($this, 'mycode_parse_list_callback'), $message, 1);

}

}

$message = $this->mycode_auto_url($message);

return $message;

}


文章来源: https://lorexxar.cn/2019/06/12/mybb-1820-rce/
如有侵权请联系:admin#unsafe.sh