Witcms smart content management system vulnerabilities and fixes

# Author: Fate
09.
10.
11.
12. Foreground injection: see Injection
13.
14. Background: shell
15.
16. MakeBug Micropoor@163.com
17.
18. // \ admin \ article_insert.php
19. // \ admin \ article_updata.php
20.
21.
22. if (! Empty ($ _ FILES [file] [name]) {
23. // omitted
24. $ file_type = $ _ FILES ["file"] ["type"]; // Save the uploaded file type as an array
25. for ($ I = 0; $ I <count ($ file_name); $ I ++ ){
26. if ($ file_name [$ I]! = ''){
27. if ($ file_type [$ I] = "image/gif") | ($ file_type [$ I] = "image/jpeg ") | ($ file_type [$ I] = "image/pjpeg") & ($ file_type [$ I] <1024000 )){
28. //... omitted. Here is the rename
29 .}
30.
31. Only the type, file header, and gif89a45sd are detected.
32.
33. Upload a sentence path by default: \ uploadfile \ + file name
34.
35. The FCKeditor editor is also called.
36.
37. Default test path: \ admin \ FCKeditor \ editor \ filemanager \ connectors \ test.html
38.
39. \ admin \ FCKeditor \ editor \ filemanager \ connectors \ uploadtest.html
Fix: Filter and upload vulnerability fix