WooYun.org

function upfiles($data = array()){ 
global $mysql; 
$error = ""; 
$file = $data['file']; 
$dateFile = date("Y-m",time()); 
$this->setData($data); 
$newDir = ROOT_PATH.$this->file_dir; 
$count = $num = 0; 
$error_msg = array(); 
$err_var = array("-2"=>"文件不存在","-3"=>"图片类型不正确","-4"=>"不是图片类型","-5"=>"上传图片过大"); 
$_result = array(); 
foreach($_FILES[$file]['name'] as $i =>$value){ 
if ($value!=""){ 
$count ++; 
$this->img_type = strtolower(substr($_FILES[$file]['name'][$i],-3,3)); 
if ($_FILES[$file]['size'][$i]==0)    $error = -2; 
if(!in_array($this->img_type,$this->file_type)) $error = -3; 
if(strpos($_FILES[$file]['type'][$i],'image')===false) $error = -4; 
if($_FILES[$file]['size'][$i] >$this->file_size*1024) $error = -5; 
if($_FILES[$file]['error'][$i] !=0 ) $error = -2; 
$this->_mkdirs($this->file_dir); 
$newFile = md5(time().rand(1,9)).$i.substr($_FILES[$file]['name'][$i],-4,4); 
$oldFile = $_FILES[$file]['name'][$i]; 
$allFile = $newDir.$newFile; 
if ($error<0){ 
$error_msg[] = $oldFile.$err_var[$error]; 
}else{ 
if(function_exists('move_uploaded_file')){ 
$result = move_uploaded_file($_FILES[$file]['tmp_name'][$i],$allFile); 
}else{ 
@copy($_FILES[$file]['tmp_name'][$i],$allFile); 
} 
$this->setSrcImg($allFile); 
$this->setCutimg(); 
$this->setDstImg($allFile); 
$this->_createMask(); 
$this->_output(); 
if($data['name'][$i]==""){ 
$_name = $oldFile; 
}else{ 
$_name = $data['name'][$i]; 
} 
$sql = "insert into `{users_upfiles}` set code='{$data['code']}',aid='{$data['aid']}',user_id='{$data['user_id']}',`name`='{$_name}',filesize='{$_FILES[$file]['size'][$i]}',filetype='{$this->img_type}',fileurl='".$this->file_dir.$newFile."',filename='".$newFile."',`addtime` = '".time()."', `updatetime` = '".time()."',`addip` = '".ip_address()."',`updateip` = '".ip_address()."'";
 $mysql ->db_query($sql); 
$file_id = $mysql->db_insert_id(); 
$num++; 
} 
} 
} 
if ($num>0){ 
$sql = "select * from `{users_upfiles}` where code = '{$data['code']}' and aid = '{$data['aid']}' and if_cover = 1";
 $result = $mysql->db_fetch_array($sql); 
if($result==false){ 
$sql = "update `{users_upfiles}` set if_cover=1 where id= {$file_id}"; 
$mysql->db_query($sql); 
} 
} 
$display = "有{$count}张相片上传，其中{$num}上传成功。".join(",",$error_msg); 
return $display; 
}

name`='{$_name}'

http://demo1.wangdaixitong.com/?user&q=code/approve/realname
http://demo1.wangdaixitong.com/?user&q=code/approve/edu_status
http://demo1.wangdaixitong.com/?user&q=code/attestations/one
http://demo1.wangdaixitong.com/?user&q=code/attestations/more
等等 差不多有上传的地方都有注入