gongfuxiang
commented
3 years ago 您之前修复了主题文件上传的一个漏洞。
但是现在有一个类似的漏洞
/app/admin/appmini.php，因为你没有使用上面的方法。
http://localhost:3000/admin.php?s=appmini/index/nav_type/weixin/view_type/upload.html
然后我的文件将被上传到
sourcecode/weixin/而且我可以绕过
!IS_AJAX，甚至使用 将我的文件上传到任何可写目录../。admin.php?s=appmini/themeupload&ajax=ajax
非常感谢您的反馈、已确定问题并在 dev 分支进行了优化 https://github.com/gongfuxiang/shopxo/commit/9b74beecf85b37e4c3b028d964f5a41c150e640d
You previously fixed one vulnerability of the theme file upload .
But now there is a similar vulnerability in
/app/admin/appmini.php,because you didn't use the above method.http://localhost:3000/admin.php?s=appmini/index/nav_type/weixin/view_type/upload.htmlsourcecode/weixin/And i can bypass the
!IS_AJAX，even upload my files to any writable directory using../.admin.php?s=appmini/themeupload&ajax=ajax