PHPWind论坛5.3版postupload.php附件跨站脚本漏洞(XSS)(图)

……
$source = $db_ifftp ? $db_ftpweb."/".$fileuplodeurl : $attachdir.'/'.$fileuplodeurl;
//版块id_文件名_时间.类型
if($db_ifftp){
$ftpsize=$ftp->upload($atc_attachment,$fileuplodeurl);
} elseif(!postupload($atc_attachment,$source)){
Showmsg('upload_error');
}
if(eregi("\.(gif|jpg|png|bmp|swf)$",$atc_attachment_name) && function_exists('getimagesize')){//这里只过滤了扩展名
if(!$img_size=getimagesize($source)){
$db_ifftp ? $ftp->delete($fileuplodeurl) : P_unlink($source);
Showmsg('upload_content_error');
}
if(!$db_ifftp && $attach_ext!='swf' && $db_watermark && $img_size[0]>$db_waterwidth && $img_size[1]>$db_waterheight){
if (function_exists('imagecreatefromgif') && function_exists('imagealphablending') && ($attach_ext!='gif' || function_exists('imagegif') && ($db_ifgif==2 || $db_ifgif==1 && in_array(PHP_VERSION,array('4.4.3','4.4.4','5.1.5')))) && ($db_waterimg && function_exists('imagecopymerge') || !$db_waterimg && function_exists('imagettfbbox'))){
require_once(R_P.'require/watermark.php'); ImgWaterMark($source,$db_waterpos,$db_waterimg,$db_watertext,$db_waterfont,$db_watercolor,$db_waterpct,$db_jpgquality);
}
}
}
if(eregi("\.(gif|jpg|jpeg|png|bmp|swf)$",$atc_attachment_name)){//这里只过滤了扩展名
$ifupload=1;
if(eregi("\.swf$",$atc_attachment_name)){//这里只过滤了扩展名
$type='zip';
}else{
$type='img';
}
} elseif(eregi("\.(zip|rar)$",$atc_attachment_name)){//这里只过滤了扩展名
$ifupload=3;
$type='zip';
} elseif(eregi("\.txt$",$atc_attachment_name)){//这里只过滤了扩展名
$safecheckdb = $db_ifftp ? (function_exists('file_get_contents') ? file_get_contents($source) : '') : readover($source);
if (strpos($safecheckdb,"onload")!==false && strpos($safecheckdb,"submit")!==false && strpos($safecheckdb,"post")!==false && strpos($safecheckdb,"form")!==false){
$db_ifftp ? $ftp->delete($fileuplodeurl) : P_unlink($source);
Showmsg('upload_content_error');
} else{
$ifupload=2;
$type='txt';
}
} else{
$ifupload=3;
$type='zip';
}
$size = $db_ifftp ? ceil($ftpsize/1024) : ceil(filesize("$attachdir/$fileuplodeurl")/1024);
$atc_attachment_name=addslashes($atc_attachment_name);
if($ifreplace==0){//下面已经准备提交到数据库
$db->update("INSERT INTO pw_attachs SET fid='$fid',uid='$winduid',hits=0,name='$atc_attachment_name',type='$type',size='$size',attachurl='$fileuplodeurl',needrvrc='$needrvrc',uploadtime='$timestamp',descrip='$descrip'");
$aid = $db->insert_id();
$attachs[$aid] = array(
'aid' => $aid,
'name' => stripslashes($atc_attachment_name),//取出转译斜线便于入库
'type' => $type,
'attachurl' => $fileuplodeurl,
'needrvrc' => $needrvrc,
'size' => $size,
'hits' => 0,
'desc' => str_replace('\\','',$descrip)
);
} else {
$aid=$replacedb[$i]['aid'];
$db->update("UPDATE pw_attachs SET name='$atc_attachment_name',type='$type',size='$size',attachurl='$fileuplodeurl',needrvrc='$needrvrc',uploadtime='$timestamp',descrip='$descrip' WHERE aid='$aid'");
$oldattach[$aid]['name']=$atc_attachment_name;
$oldattach[$aid]['type']=$type;
$oldattach[$aid]['size']=$size;
}
}
……