Another Arbitrary File Upload Vulnerability in ThinkSNS

A module does not verify the upload file type. Attackers can upload arbitrary files.
Someone found an arbitrary Upload Vulnerability. So I looked at it. Don't know if it's consistent with his address: http://www.bkjia.com/Article/201212/172844.html
Code Generation location apps \ wap \ Lib \ Action \ IndexAction. class. php263 if (! Empty ($ _ FILES ['pic '] ['name']) {// automatically send an image microblog $ data ['pic '] =$ _ FILES ['pic']; $ data ['content'] = 'image sharing '; $ data ['from'] = $ this-> _ type_wap; $ res = api ('statuses ')-> data ($ data)-> upload ();} access the wap module without filtering the file type and send a microblog and send the firebug address
Remove small _ and access http://www.bkjia.com/data/uploads/2012/1023/17/50865 d481c217. phpSolution:Check the upload type