WooYun.org

$module = trim($_REQUEST['module']) ? trim($_REQUEST['module']) : 'login';
        $action = trim($_REQUEST['action']) ? trim($_REQUEST['action']) : '';
        if ($module == 'home' || $module == 'main' || $module == 'login' || $module == 'logout' || $module == 'password') {
            $action = $module;
            $module = 'page_frame';
        }
        if ($offset = @strpos($module, '_')) {
            $folder = substr($module, 0, $offset);
            $file = substr($module, $offset + 1);
            $filename = ROOTPATH . '/modules/' . $folder . '/' . $file . '.mds.php';
            if (!file_exists($filename)) {
                $filename = ROOTPATH . '/modules/' . $folder . '/' . $file . '.php';
            }
        } else {
            $filename = ROOTPATH . '/modules/' . $module . '.mds.php';
            if (!file_exists($filename)) {
                $filename = ROOTPATH . '/modules/' . $module . '.php';
            }
        }
        if (!file_exists($filename)) {
            die('Not Found');
        }
        require_once $filename;

else if ($action == 'local_import') {
    /* if ($_FILES["file"]["error"] > 0)
      {
      include template('system_upload_file');
      return;
      } */
    if (!empty($_FILES["file"]["error"])) {
        switch ($_FILES["file"]['error']) {
            case '1':
                $error = 'The uploaded file exceeds the upload_max_filesize directive in php.ini';
                break;
            case '2':
                $error = 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form';
                break;
            case '3':
                $error = 'The uploaded file was only partially uploaded';
                break;
            case '4':
                $error = 'No file was uploaded.';
                break;
            case '6':
                $error = 'Missing a temporary folder';
                break;
            case '7':
                $error = 'Failed to write file to disk';
                break;
            case '8':
                $error = 'File upload stopped by extension';
                break;
            case '999':
            default:
                $error = 'No error code avaiable';
        }
        echo $error;
    } else if (empty($_FILES['file']['tmp_name']) || $_FILES['file']['tmp_name'] == 'none') {
        $error = 'No file was uploaded......';
        echo $error;
    } else {
        $param['filename'] = $_FILES["file"]["name"];
        $newfilename = "/tmp/" . $_FILES["file"]["name"];
        if ($_POST['des'])
            $param['comments'] = formatpost($_POST['des']);
        if (move_uploaded_file($_FILES["file"]["tmp_name"], $newfilename)) {
            $rspString = getResponse('system firmware', "webimport", $param, 2);
            if (is_numeric($rspString) && $rspString == 0) {
                echo 'ok';
            } else {
                echo $rspString;
            }
        } else {
            include template('system_upload_file');
        }
    }

move_uploaded_file($_FILES["file"]["tmp_name"], $newfilename

$newfilename = "/tmp/" . $_FILES["file"]["name"];

<form action="**.**.**.**/index.php?module=system_config&action=importHandle" method="post" enctype="multipart/form-data">
	    <input type="file" name="file">
        <input type="submit" name="dosubmit" value="上传" style="margin-top:5px; height:28px;">
    </form>

if ($action == "import") {
51         $upFilePath = "/usr/local/apache2/htdocs/attachements/";
52         if ($_FILES['file']['size'] > 819200) {   //可输入变量$_FILES 可能存在安全威胁
53             echo json_encode(array('file_infor' => 'error:上传失败,文件过大,最大800K'));
54             return;
55         }
56         $ok=@move_uploaded_file($_FILES['file']['tmp_name'], $upFilePath.$_FILES['file']['name']);   //可输入变量$_FILES 可能存在安全威胁
57         if($ok === FALSE){
58             echo json_encode(array('file_infor' => 'error:上传失败'));
59         } else {
60             $err = "";
61             $fp = fopen($upFilePath.$_FILES['file']['name'], "r");   //可输入变量$_FILES 可能存在安全威胁
62             while($line = fgets($fp)) {
63                 $param['whitelist'] =  formatpost($line);
64                 $rspString = getResponse("ddos global", "add", $param, 2);
65                 if (is_string($rspString)) {
66                     $err = $rspString;
67                 } else{
68                     $sql = "INSERT INTO ads_static_wlist values"."('".formatpost($line)."') ";
69                     $db->query($sql);
70                 }
71             }