雪晖在线投票系统 php 版上传漏洞

imgupload.php：

require_once("conn.php");
header("Content-type:text/html;charset=gbk");
$tid = $_POST["tid"];
$sid = "";
$query = mysql_query("select sid from xh_title where id=".$tid,$conn);
if($row=mysql_fetch_array($query)){
$sid = $row["sid"];
}
mysql_free_result($query);
$uploadDir = "xh_upload/".$sid."/".$tid;
if(!is_dir($uploadDir)){
@mkdir($uploadDir,0777,true);
}
$type=array("jpg","gif","png","bmp","jpeg");
$filename=$_FILES["ImgFile"]["name"];
$fileExt=trim(substr($filename,strrpos($filename,".")+1));
if(!in_array(strtolower($fileExt),$type)){
$text = implode(",",$type);
mysql_close($conn);
die("");
}
$newFileName=$uploadDir."/".date("YmdHis").$filename;
if(move_uploaded_file($_FILES["ImgFile"]["tmp_name"],$newFileName)){
mysql_close($conn);
die("");
}else{
mysql_close($conn);
die("");
}
mysql_close($conn);
?>