phpmps后台getshell

admin/flash.php 30-58行
[php]
case 'insert':
if(empty($_REQUEST['url']))show('链接不能为空');
if(empty($_FILES['file']['name']))
{
show('没有上传图片');
}
else
{
$name = date('Ymd');
for($i = 0;$i < 6;$i++) {
$name .= chr(mt_rand(97, 122));
}
$name .= '.' . end(explode('.', $_FILES['file']['name']));
$to = PHPMPS_ROOT . 'data/flashimage/' . $name;

if (move_uploaded_file($_FILES['file']['tmp_name'], $to)){
$image = "data/flashimage/" . $name;
}
}
$url = trim($_REQUEST['url']);
$flaorder = intval($_REQUEST['order']);
$sql = "INSERT INTO {$table}flash (image,url,flaorder) VALUES ('$image','$url','$flaorder');";
$res = $db->query($sql);
$res ? $msg = "添加成功" : $msg = "添加失败";
clear_caches('phpcache', 'flash');

admin_log("添加flash $name 成功");
show($msg, 'flash.php?act=add');
break;[/php]
只是检测是否有上传对于上传的什么没作过滤，直接的getshell