WooYun.org

$_REQUEST['m']="UcModify";
	$_REQUEST['a']="save_avatar";
	include ROOT_PATH."app/source/index.php"; //进去看看

....沈略.......
	$ma = strtolower($_REQUEST['m'].'_'.$_REQUEST['a']);
	switch($ma){
	case 'ucmodify_save_avatar':
	require ROOT_PATH.'app/source/func/com_user_center_func.php';
	require ROOT_PATH."app/source/user_center.php"; //关键代码
	break;
     ....沈略.......

user_enter_init (); //会员菜单初始化
$userid = intval ( $_SESSION ['user_id'] );
$ma = $_REQUEST ['m'] . "_" . strtolower ( $_REQUEST ['a'] );
$ma ( $userid );
exit ();
function UcModify_save_avatar($userid)
{
	@header("Expires: 0");
	@header("Cache-Control: private, post-check=0, pre-check=0, max-age=0", FALSE);
	@header("Pragma: no-cache");
	//这里传过来会有两种类型，一先一后, big和small, 保存成功后返回一个json字串，客户端会再次post下一个.
	$type = isset($_GET['type'])?trim($_GET['type']):'small';//这里type我们可以控制
	$pic_id = $userid;
	//$orgin_pic_path = $_GET['photoServer']; //原始图片地址，备用.
	//$from = $_GET['from']; //原始图片地址，备用.
	if (! is_dir ( ROOT_PATH . 'Public/upload/avatar/avatar_'.$type ))//创建目录 利用iis6解析漏洞 可以执行代码
		mkdir ( ROOT_PATH . 'Public/upload/avatar/avatar_'.$type);
	//生成图片存放路径
	$new_avatar_path = 'avatar_'.$type.'/'.$pic_id.'.jpg';
	//将POST过来的二进制数据直接写入图片文件.
	@file_put_contents(ROOT_PATH.'Public/upload/avatar/'.$new_avatar_path,file_get_contents("php://input"));
	//原始图片比较大，压缩一下. 效果还是很明显的, 使用80%的压缩率肉眼基本没有什么区别
	//小图片 不压缩约6K, 压缩后 2K, 大图片约 50K, 压缩后 10K
	$avtar_img = imagecreatefromjpeg(ROOT_PATH.'Public/upload/avatar/'.$new_avatar_path);
	imagejpeg($avtar_img,ROOT_PATH.'Public/upload/avatar/'.$new_avatar_path,80);
	//nix系统下有必要时可以使用 chmod($filename,$permissions);
	//输出新保存的图片位置, 测试时注意改一下域名路径, 后面的statusText是成功提示信息.
	//status 为1 是成功上传，否则为失败.
	$d = new pic_data();
	//$d->data->urls[0] = 'http://sns.com/avatar_test/'.$new_avatar_path;
	$d->data->urls[0] = '/Public/upload/avatar/'.$new_avatar_path;
	$d->status = 1;
	$d->statusText = a_L('UPLOAD_SUCCESS');
	$msg = json_encode($d);
	
	echo $msg;
}

function getIP() {
	static $realip;
    if (isset($_SERVER)){
        if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])){ //我们可以直接伪造的
            $realip = $_SERVER["HTTP_X_FORWARDED_FOR"];
        } else if (isset($_SERVER["HTTP_CLIENT_IP"])) {
            $realip = $_SERVER["HTTP_CLIENT_IP"];
        } else {
            $realip = $_SERVER["REMOTE_ADDR"];
        }
    } else {
        if (getenv("HTTP_X_FORWARDED_FOR")){
            $realip = getenv("HTTP_X_FORWARDED_FOR");
        } else if (getenv("HTTP_CLIENT_IP")) {
            $realip = getenv("HTTP_CLIENT_IP");
        } else {
            $realip = getenv("REMOTE_ADDR");
        }
    }
    return $realip;
}

$client_ip = $iplocation->getIP();
$_SESSION['CLIENT_IP'] = $client_ip; //把获取到的ip存入session中

$sql_str = 'update ' . DB_PREFIX . 'user set last_ip = \'' . $_SESSION ['CLIENT_IP'] . '\',active_sn = \'\',group_id= ' . intval ( $userinfo ['group_id'] ) . ' where id = ' . intval ( $userinfo ['id'] );