SRC上分 - 某CMS存在文件上传漏洞

漏洞分析

网站系统为狮子鱼社区团购系统，漏洞文件为CK编辑器的image_upload.php，漏洞源码如下所示：

 $max_size) { // 判断文件大小是否大于500000字节
    echo '{"result":"400","msg":"上传图片太大，最大支持：'.($max_size/1024).'KB"}';
    exit ();
  }
  if (! in_array ( $file ['type'], $arrType )) { // 判断图片文件的格式
    echo '{"result":"400","msg":"上传图片格式不对"}';
    exit ();
  }
  if (! file_exists ( $upfile )) { // 判断存放文件目录是否存在
    mkdir ( $upfile, 0777, true );
  }
  $imageSize = getimagesize ( $file ['tmp_name'] );
  $img = $imageSize [0] . '*' . $imageSize [1];
  $fname = $file ['name'];
  $ftype = explode ( '.', $fname );
  $time = explode ( " ", microtime () );
  $time = $time [1] . ($time [0] * 1000);
  $time2 = explode ( ".", $time );  
  $time = $time2 [0];
  $returnName=$time."." .end($ftype);
  $picName = $upfile . "/" . $returnName ;

  if (! move_uploaded_file ( $file ['tmp_name'], $picName )) {
    echo '{"result":"400","msg":"从:'.$file ['tmp_name'].'移动图片到:'.$picName.'出错"}';
    exit ();
  } else {
    echo '{"result":"200","imgurl":"image/uploads/' . $returnName . '"}';
  }
}
?>