Wordpress File-manager 任意文件上传漏洞分析

public function commandArgsList($cmd){        if ($this->commandExists($cmd)) {            $list = $this->commands[$cmd];            $list['reqid'] = false;        } else {            $list = array();        }        return $list;}/*upload对应的数组如下:'upload' => array(    'target' => true, 'FILES' => true, 'mimes' => false, 'html' => false, 'upload' => false,    'name' => false, 'upload_path' => false, 'chunk' => false, 'cid' => false, 'node' => false,    'renames' => false, 'hashes' => false, 'suffix' => false, 'mtime' => false, 'overwrite' => false,    'contentSaveId' => false)    */

public function upload($fp, $dst, $name, $tmpname, $hashes = array()){        if ($this->commandDisabled('upload')) {            return $this->setError(elFinder::ERROR_PERM_DENIED);        }
        if (($dir = $this->dir($dst)) == false) {            return $this->setError(elFinder::ERROR_TRGDIR_NOT_FOUND, '#' . $dst);        }
        if (empty($dir['write'])) {            return $this->setError(elFinder::ERROR_PERM_DENIED);        }
        if (!$this->nameAccepted($name, false)) {            return $this->setError(elFinder::ERROR_INVALID_NAME);        }
        $mimeByName = '';        if ($this->mimeDetect === 'internal') {            $mime = $this->mimetype($tmpname, $name);        } else {            $mime = $this->mimetype($tmpname, $name);            $mimeByName = $this->mimetype($name, true);            if ($mime === 'unknown') {                $mime = $mimeByName;            }        }
        if (!$this->allowPutMime($mime) || ($mimeByName && !$this->allowPutMime($mimeByName))) {            return $this->setError(elFinder::ERROR_UPLOAD_FILE_MIME, '(' . $mime . ')');        }
        $tmpsize = (int)sprintf('%u', filesize($tmpname));        if ($this->uploadMaxSize > 0 && $tmpsize > $this->uploadMaxSize) {            return $this->setError(elFinder::ERROR_UPLOAD_FILE_SIZE);        }
        $dstpath = $this->decode($dst);        if (isset($hashes[$name])) {            $test = $this->decode($hashes[$name]);            $file = $this->stat($test);        } else {            $test = $this->joinPathCE($dstpath, $name);            $file = $this->isNameExists($test);        }
        $this->clearcache();
        if ($file && $file['name'] === $name) { // file exists and check filename for item ID based filesystem            if ($this->uploadOverwrite) {                if (!$file['write']) {                    return $this->setError(elFinder::ERROR_PERM_DENIED);                } elseif ($file['mime'] == 'directory') {                    return $this->setError(elFinder::ERROR_NOT_REPLACE, $name);                }                $this->remove($test);            } else {                $name = $this->uniqueName($dstpath, $name, '-', false);            }        }
        $stat = array(            'mime' => $mime,            'width' => 0,            'height' => 0,            'size' => $tmpsize);
        // $w = $h = 0;        if (strpos($mime, 'image') === 0 && ($s = getimagesize($tmpname))) {            $stat['width'] = $s[0];            $stat['height'] = $s[1];        }        // $this->clearcache();        if (($path = $this->saveCE($fp, $dstpath, $name, $stat)) == false) {            return false;        }
        $stat = $this->stat($path);        // Try get URL        if (empty($stat['url']) && ($url = $this->getContentUrl($stat['hash']))) {            $stat['url'] = $url;        }
        return $stat;}

Array(    [isowner] =>    [ts] => 1589423646    [mime] => directory    [read] => 1    [write] => 1    [size] => 0    [hash] => l1_Lw    [name] => files    [rootRev] =>    [options] => Array        (            [path] =>            
 => /wordpress/wp-content/plugins/wp-file-manager/lib/php/../files/            [tmbUrl] => /wordpress/wp-content/plugins/wp-file-manager/lib/php/../files/.tmb/            [disabled] => Array                (                    [0] => chmod                )
            [separator] =>             [copyOverwrite] => 1            [uploadOverwrite] => 1            [uploadMaxSize] => 9223372036854775807            [uploadMaxConn] => 3            [uploadMime] => Array                (                    [firstOrder] => deny                    [allow] => Array                        (                            [0] => all                        )
                    [deny] => Array                        (                            [0] => all                        )
                )
            [dispInlineRegex] => ^(?:(?:video|audio)|image/(?!.++xml)|application/(?:ogg|x-mpegURL|dash+xml)|(?:text/plain|application/pdf)$)            [jpgQuality] => 100            [archivers] => Array                (                    [create] => Array                        (                            [0] => application/x-tar                            [1] => application/zip                        )
                    [extract] => Array                        (                            [0] => application/x-tar                            [1] => application/zip                        )
                    [createext] => Array                        (                            [application/x-tar] => tar                            [application/zip] => zip                        )
                )
            [uiCmdMap] => Array                (                )
            [syncChkAsTs] => 1            [syncMinMs] => 10000            [i18nFolderName] => 0            [tmbCrop] => 1            [tmbReqCustomData] =>            [substituteImg] => 1            [onetimeUrl] => 1            [trashHash] => t1_Lw            [csscls] => elfinder-navbar-root-local        )
    [volumeid] => l1_    [locked] => 1    [isroot] => 1    [phash] =>)