### 任意文件上传共四处,属于同一个漏洞
文件位置
```
/webservice/upload.php
/webservice/upload/upload.php
/webservice-json/upload/upload.php
/webservice-xml/upload/upload.php
```
四处都有如下代码
```
<?php
include_once( "inc/utility_all.php" );
$pathInfor = pathinfo( $_FILES['file']['tmp_name'] );
$extension = $pathInfor['extension'];
$role = UPLOADROLE;
$pos = $extension ? strpos( $role, strtoupper( $extension ) ) : false;
if ( !( $pos === false ) )
{
echo "false";
}
else
{
$attachmentID = createfiledir( );
global $ATTACH_PATH;
$path = $ATTACH_PATH.$attachmentID;
if ( !file_exists( $path ) )
{
mkdir( $path, 448 );
}
$attachmentName = $_FILES['file']['tmp_name'];
$fileName = $path."/".$_FILES['file']['name'];
$fileName = iconv( "UTF-8", "GBK", $fileName );
move_uploaded_file( $_FILES['file']['tmp_name'], $fileName );
if ( !file_exists( $fileName ) )
{
echo "false";
}
else
{
echo $attachmentID."*".$_FILES['file']['name'];
}
}
?>
```
没有对文件有任何验证,无须登陆
文件上传之后的位置是:
```
$path = $ATTACH_PATH.$attachmentID;
$fileName = $path."/".$_FILES['file']['name'];
move_uploaded_file( $_FILES['file']['tmp_name'], $fileName );
```
四处代码一样,不再重复贴代码。
暂无评论