From a43a6f22944e769a6eabc58c39e7bc18c1cab4ca Mon Sep 17 00:00:00 2001 From: dvz Date: Mon, 28 Aug 2023 19:25:35 +0200 Subject: [PATCH] Fix ACP Templates RCE --- admin/inc/functions.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/admin/inc/functions.php b/admin/inc/functions.php index 15e00658da..0d6901d3b1 100644 --- a/admin/inc/functions.php +++ b/admin/inc/functions.php @@ -667,20 +667,21 @@ function is_mobile($useragent) function check_template($template) { // Check to see if our database password is in the template - if(preg_match('#\$config\[(([\'|"]database[\'|"])|([^\'"].*?))\]\[(([\'|"](database|hostname|password|table_prefix|username)[\'|"])|([^\'"].*?))\]#i', $template)) + if(preg_match('#\$config\[(([\'|"]database[\'|"])|([^\'"].*?))\]\[(([\'|"](database|hostname|password|table_prefix|username)[\'|"])|([^\'"].*?))\]#i', $template) !== 0) { return true; } // System calls via backtick - if(preg_match('#\$\s*\{#', $template)) + if(preg_match('#\$\s*\{#', $template) !== 0) { return true; } // Any other malicious acts? // Courtesy of ZiNgA BuRgA - if(preg_match("~\\{\\$.+?\\}~s", preg_replace('~\\{\\$+[a-zA-Z_][a-zA-Z_0-9]*((?:-\\>|\\:\\:)\\$*[a-zA-Z_][a-zA-Z_0-9]*|\\[\s*\\$*([\'"]?)[a-zA-Z_ 0-9 ]+\\2\\]\s*)*\\}~', '', $template))) + $allowed = preg_replace('~\\{\\$+[a-zA-Z_][a-zA-Z_0-9]*((?:-\\>|\\:\\:)\\$*[a-zA-Z_][a-zA-Z_0-9]*|\\[\s*\\$*([\'"]?)[a-zA-Z_ 0-9 ]+\\2\\]\s*)*\\}~', '', $template); + if($allowed === null || preg_match("~\\{\\$.+?\\}~s", $allowed) !== 0) { return true; }