bo-blog2.0.3文件浏览漏洞

O-blog2.0.3的编辑器存在一个文件浏览漏洞,存在漏洞文件在于whizzylink.php和whizzypic.php,不过前一个可以浏览任意文件和目录,后一个只能浏览目录和图片,并能查看图片&lt;br /&gt; &lt;br /&gt; $docpath = $_REQUEST['d'];&lt;br /&gt; $extensions = $_REQUEST['x'] ? '/(' . $_REQUEST['x'] .')$/i' : '/\.(html|pdf|txt)$/i';&lt;br /&gt; $d = $_SERVER['DOCUMENT_ROOT'] . '/' . $docpath;&lt;br /&gt; $d = str_replace('//','/',$d);&lt;br /&gt; $dir = opendir($d);&lt;br /&gt; while ($file = readdir($dir)){&lt;br /&gt; $files[] = $file;&lt;br /&gt; }&lt;br /&gt; closedir($dir);&lt;br /&gt; usort($files, &quot;insensitive&quot;); //see function insensitive($a, $b)&lt;br /&gt; foreach ($files as $filename) {&lt;br /&gt; $filepath = &quot;$d/$filename&quot;;&lt;br /&gt; $fsize = sprintf(&quot;%u&quot;, filesize($filepath)); //filesizes over 2Mb won't fit in an int so we unsign it&lt;br /&gt; $modtime = date (&quot;d F Y H:i:s&quot;, filemtime($filepath)); //mtime is unix timestamp&lt;br /&gt; $tip = &quot; Size: $fsize &lt;br&gt;Updated: $modtime &quot;;&lt;br /&gt; if (is_dir($filepath) &amp;&amp; $docpath) { //it's a directory&lt;br /&gt; if ($filename == '.'){ //current directory&lt;br /&gt; $dlist .= &quot;&lt;img src='/btn/dir.png'&gt; $docpath &quot;;&lt;br /&gt; } else if ($filename == '..') { //parent directory&lt;br /&gt; if($docpath) { //we're in a sub directory - no Up from root&lt;br /&gt; $updir = substr($docpath,0,strrpos($docpath,'/'));&lt;br /&gt; $dlist .= &quot;&lt;img src='/btn/back.png'&gt;&lt;a href='$self?d=$updir'&gt;Up&lt;/a&gt;/&lt;br&gt;&quot;;&lt;br /&gt; }&lt;br /&gt; } else {&lt;br /&gt; $docpath = str_replace($_SERVER['DOCUMENT_ROOT'], &quot;&quot;, $d);&lt;br /&gt; $dlist .= &quot;&lt;div style='float:left;width:20em'&gt;&lt;img src='/btn/dir.png'&gt;&lt;a href='$self?d=$docpath/$filename'&gt;$filename&lt;/a&gt;&lt;/div&gt;&quot;; &lt;br /&gt; }&lt;br /&gt; } else if (preg_match($extensions,$filename) ) {&lt;br /&gt; $flist .= &quot;&lt;div style='float:left;width:20em'&gt;&lt;a href='#' onclick='WantThis(\&quot;$docpath/$filename\&quot;)'&gt;$filename&lt;/a&gt;&lt;/div&gt;&quot;;&lt;br /&gt; bo-blog2.0.3 <a href="http://www.bo-blog.com" target="_blank">http://www.bo-blog.com</a>