怕是神经病吧，这垃圾玩意都开源了还，版权所有，翻版必究，未经同意不得用于商业项目

you can upload any file as avatar at " /index.php?m=user&a=avatar". Althought the server's response show that you are fail to set avatar, but the file was uploaded,And the file can be easily to locate by uid which shows in your cookies.

/action/Core.class.php

 public function upload() {
        if (!$_REQUEST['uid']) {
            echo Response::json(LACK, array(tip('用户ID不能为空')));
            exit;
        }
        $_REQUEST['name'] = self::filterName(rawurldecode(self::trimSpace($_REQUEST['name'])));
        if (!$_REQUEST['name']) {
            echo Response::json(LACK, array(tip('文件名不能为空')));
            exit;
        }
        if (!$_REQUEST['type']) {
            if (!file_exists(DATA_DIR)) {
                $res = mkdir(DATA_DIR, 0777, true);
                if (!$res) {
                    echo Response::json(FAIL, array(tip('存储目录创建失败')));
                    exit;
                }
            }
        }
        if (!file_exists(UP_DIR)) {
            $res = mkdir(UP_DIR, 0777, true);
            if (!$res) {
                echo Response::json(FAIL, array(tip('存储目录创建失败')));
                exit;
            }
        }
        include LIB_PATH . 'plupload' . DS . 'PluploadHandler.php';
        PluploadHandler::no_cache_headers();
        PluploadHandler::cors_headers();
        if (!PluploadHandler::handle(array(
            'target_dir' => UP_DIR,
            //'allow_extensions' => 'jpg,jpeg,png'
        ))) {
            echo Response::json(FAIL, array(tip('上传失败')));
            exit;
        } else {
            echo Response::json(SUCC, array(tip('上传成功')));
        }
    }

if I logined uid is 185 and my upload filename is backdoor.php. Then http://mywebsite.com/files/18/05/backdoor.php is my really backdoor.

what's more:
I think the line "//'allow_extensions' => 'jpg,jpeg,png'" is not good to be commented.

我承认这个源码很好，但是不支持mysqli是个很悲催的事情。对了flash现在越来越多的设备不用了，建议去掉flash.

請問有分享至群組的功能嗎?我似乎只看到分享給個人的部份

Summary

A reflected Cross Site Scripting (XSS) vulnerability exists in iBarn v1.5 due to improper sanitization of the $search parameter in the html/index.php, html/pay.php, and html/own.php files. Although the htmlspecialchars function is used to encode HTML entities, the developers utilized the flag ENT_NOQUOTES, which does not encode single or double quotes, leading to the vulnerability.

Details

The misuse of the htmlspecialchars function allows the injection of JavaScript code into the search field, which can be exploited for XSS attacks.

html/index.php:

   <input type="text" class="form-control" id="search" name="search" value="<?php echo htmlspecialchars($_REQUEST['search'], ENT_NOQUOTES); ?>" placeholder="<?php echo t('搜你想要'); ?>">

html/pay.php:

   <input type="text" class="form-control" id="search" name="search" value="<?php echo htmlspecialchars($_REQUEST['search'], ENT_NOQUOTES); ?>" placeholder="搜你想要">

html/own.php:

   <input type="text" class="form-control" id="search" name="search" value="<?php echo htmlspecialchars($_REQUEST['search'], ENT_NOQUOTES); ?>" placeholder="<?php echo t('搜你想要'); ?>">

Proof of Concept (PoC)

http(s)://ip:port/index.php?search=1%22%20onmouseover=alert(document.cookie)%20bad=%221

Differentiation from CVE-2024-26471

This vulnerability is distinct from CVE-2024-26471 as it specifically targets the $search parameter processed through the htmlspecialchars function and then bypasses filtering.
Although CVE-2024-26471 only mentioned that the search field in html/offer.php lacks any filtering, our investigation revealed that several other pages (shareme.php, recycle.php, collection.php, pub.php, myshare.php) also do not filter the $search parameter, leading to multiple cross-site scripting (XSS) vulnerabilities.

sql语句存在兼容性问题 我的mysql版本5.7.16 PHP7.1
表中的time字段 DEFAULT '0000-00-00 00:00:00' 会报错 导致无法安装 为什么不用int 存时间戳呢?
分享提示操作失败 我等下去看下是啥问题
客户端运行没反应... win7 x64

似乎有个小问题，上传一个文件然后删除再还原，文件仍然存在，但是占用空间还原时并没有更新，需要重新上传个文件才会更新

太不专业了

http://www.godeye.org:82/

点击左侧的导航栏，右侧页面刷新时出现右侧边框有黑线闪一下。

差评

http://xxx.xxx.xxx/admin或者admin.php进入不了后台

当文件名为中文，点击下载会服务器500错误。

感谢版主开发的软件，反应很快。我在上传ziprar等格式文件提示目录不存在，上传png等图片正常。在uploadconfig里没有看到zip等设置，是不行吗？

有手机客户端吗

请教 iBarn-win-1.1win客户端如何使用？