起因 https://www.t00ls.net/viewthread.php?tid=56414
漏洞分析 入口 Public/Inner/Js/uploader/server/php/index.php ：
1 2 3 4 5 <?php error_reporting(E_ALL | E_STRICT); require('UploadHandler.php'); $upload_handler = new UploadHandler(); 关键代码 Public/Inner/Js/uploader/server/php/UploadHandler.php ：
初始化操作：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 <?php class UploadHandler { protected $options; protected $error_messages = array( //忽略 ); protected $image_objects = array(); function __construct($options = null, $initialize = true, $error_messages = null) { $this->options = array( 'script_url' => $this->get_full_url().'/', 'upload_dir' => dirname($this->get_server_var('SCRIPT_FILENAME')).'/files/', 'upload_url' => $this->get_full_url().'/files/', 'user_dirs' => false, 'mkdir_mode' => 0755, 'param_name' => 'files', 'delete_type' => 'DELETE', 'access_control_allow_origin' => '*', 'access_control_allow_credentials' => false, 'access_control_allow_methods' => array( 'OPTIONS', 'HEAD', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE' ), 'access_control_allow_headers' => array( 'Content-Type', 'Content-Range', 'Content-Disposition' ), 'download_via_php' => false, 'readfile_chunk_size' => 10 * 1024 * 1024, // 10 MiB 'inline_file_types' => '/\.(gif|jpe?g|png)$/i', 'accept_file_types' => '/.+$/i', 'max_file_size' => null, 'min_file_size' => 1, 'max_number_of_files' => null, 'image_file_types' => '/\.(gif|jpe?g|png)$/i', 'correct_image_extensions' => false, 'max_width' => null, 'max_height' => null, 'min_width' => 1, 'min_height' => 1, 'discard_aborted_uploads' => true, 'image_library' => 1, 'convert_bin' => 'convert', 'identify_bin' => 'identify', 'image_versions' => array( '' => array( 'auto_orient' => true ), 'thumbnail' => array( 'max_width' => 80, 'max_height' => 80 ) ) ); if ($options) { $this->options = $options + $this->options; //初始化配置 } if ($error_messages) { $this->error_messages = $error_messages + $this->error_messages; // 初始化错误信息 } if ($initialize) { $this->initialize(); //初始化操作 } } protected function initialize() { // 根据HTTP请求方法调用函数 switch ($this->get_server_var('REQUEST_METHOD')) { case 'OPTIONS': case 'HEAD': $this->head(); break; case 'GET': $this->get(); break; case 'PATCH': case 'PUT': case 'POST': $this->post(); break; case 'DELETE': $this->delete(); break; default: $this->header('HTTP/1.1 405 Method Not Allowed'); } } 跟进 post 函数:
...