WooYun.org

<?php
if (isset($_REQUEST['cmd']))
	$cmd = $_REQUEST['cmd'];
else
	$cmd = "NULL";
$with_cert = 1;
$pass = "";
include_once "management/system.php";
if ($cmd == $LANG_IMPORT) {
	if ($_FILES['userfile']) {
		$file_size = $_FILES['userfile']['size'];
		$file_type = $_FILES['userfile']['type'];
	
		$temp_name = $_FILES['userfile']['tmp_name'];
		$file_name = $_FILES['userfile']['name'];
		$file_name = str_replace("\\","",$file_name);
		$file_name = str_replace("'","",$file_name);
		$file_name = str_replace(" ","",$file_name);
		$file_path = $CFG_UPLOAD_PATH."__im_data__.bin";
		//File Name Check
		if ( $file_name == "" ) { 
			echo "Invalid File Name Specified";
			return;
		}
		$result  =  move_uploaded_file($temp_name, $file_path);
		chmod($file_path, 0777);
	} else {
		$msg = "no upload file\n";
		include "include/error.php";
		return;
	}
	if (isset($_POST['pass_import']))
		$pass = $_POST['pass_import'];
	$SM = new SystemManager;
	$msg = $SM->Import_Export($ticket, $pass, 1, 0);
	if ($msg == "OK")
		$msg = $RESTART_MSG;
	include "include/error.php";
	return;
}
if ($cmd == $LANG_EXPORT) {
	if (isset($_POST['pass_export']))
		$pass = $_POST['pass_export'];
	$SM = new SystemManager;
	$V = $SM->Import_Export($ticket, $pass, 2, $with_cert);
	$file_name = "/data/upload/__ex_data__.bin";
	/*
	header("Pragma: "); 
	header("Cache-Control: "); 
	header("Content-type: application/octet-stream");  
	header("Content-Length: ".filesize($file_name));
	header("Content-Disposition: attachment; filename=\"sysbackup.bin\"");
	readfile($file_name);
	unlink($file_name);
	 */
}
?>

$result = move_uploaded_file($temp_name, $file_path);

$file_path = $CFG_UPLOAD_PATH."__im_data__.bin";