Tipask Q & A system 1.4 Upload Vulnerability and repair

 

By: Mind

This vulnerability is quite interesting...

 

User. php (user operation ):

 

Function oneditimg () {// modify the Avatar

If (isset ($ _ FILES ["Filedata"]) {

$ Upload_tmp_path = "data/tmp /";

$ FileName = 'biginatar '. $ this-> user ['uid']. '. '. substr ($ _ FILES ["Filedata"] ['name'],-3 );

Move_uploaded_file ($ _ FILES ["Filedata"] ["tmp_name"], $ upload_tmp_path. $ fileName );

// This is enough .........

$ Img = getimagesize ($ upload_tmp_path. $ fileName );

$ Imginfo = array ();

$ Imginfo ['src'] = SITE_URL. $ upload_tmp_path. $ fileName .'? '. Time ();

$ Imginfo ['W'] = $ img [0];

$ Imginfo ['H'] = $ img [1];

$ Imginfo ['ext '] = $ img [2];

Echo json_encode ($ imginfo );

// The upload path .....

} Else {

If ($ this-> setting ["ucenter_open"]) {

$ This-> load ('ucenter ');

$ Imgstr = $ _ ENV ['ucenter']-> set_avatar ($ this-> user ['uid']);

}

Include template ("editimg ");

}

}

 

 

 

Everything comes straight ..

 

You don't need to check the suffix of data/tmp/bigavatar X. php.

 

T00ls initial... reprinted please indicate t00ls... thank you