php网站图片上传攻击,你不知道的文件上传漏洞php代码分析

漏洞描述

开发中文件上传功能很常见，作为开发者，在完成功能的基础上我们一般也要做好安全防护。

文件处理一般包含两项功能，用户上传和展示文件，如上传头像。

文件上传攻击示例

upload.php

$uploaddir = 'uploads/';

$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)){

echo "File is valid, and was successfully uploaded.\n";

}

else {

echo "File uploading failed.\n";

}

?>

upload.html

Select the file to upload:

上述代码未经过任何验证，恶意用户可以上传php文件，代码如下

恶意用户可以通过访问 如http://server/uploads/shell.php?command=phpinfo(); 来执行远程命令

Content-type验证

upload.php

if($_FILES['userfile']['type'] != "image/gif") {//获取Http请求头信息中ContentType

echo "Sorry, we only allow uploading GIF images";

exit;

}

$uploaddir = 'uploads/';

$uploadfile = $uploaddir.basename($_FILES['userfile']['name']);

if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)){

echo "File is valid, and was successfully uploaded.\n";

} else {

echo "File uploading fail