TEC

my11502207 发表于 2018-12-14 07:24:06

　　修改download?u参数值，将/public/files/14842030529.txt，替换为../../../../../../../../../../etc/passwd
function download() {
   $u =$_GET['u'];
   // 描述：任意文件读取漏洞修复date: 2017年4月28日下午4:13:39bylwy
   $lenth=strrpos($u,'.');
   $string = substr($u,0,$lenth);
   $end=substr($u,$lenth);
   $string = str_replace ( array ('.'), array ('╭(⊙^⊙)╮'), $string );
   $string .=$end;
   // 描述：任意文件读取漏洞修复date: 2017年4月28日下午4:13:39bylwy
   if (file_exists($file)){
      header('Content-Description: File Transfer');
      header('Content-Type: application/octet-stream');
      header('Content-Disposition: attachment; filename='.basename($file));
      header('Content-Transfer-Encoding: binary');
      header('Expires: 0');
      header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
      header('Pragma: public');
      header('Content-Length: ' . filesize($file));
      ob_clean();
      flush();
      readfile($file);
      exit;
   }else{
      echo "文件下载错误！";
   }
}https://s2.运维网.com/wyfs02/M00/93/3E/wKiom1kJhuWSx6VoAADEcBUlkIE081.png-wh_500x0-wm_3-wmp_4-s_332356294.png

页: [1]

运维网's Archiver

TEC