代码审计——DVWA File Upload（文件上传）

Low等级代码

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
   
    // Where are we going to be writing to?
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // Can we move the file to the upload folder?
    if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
   
        // No
        echo '<pre>Your image was not uploaded.</pre>';
    }
    else {
   
        // Yes!
        echo "<pre>{
     $target_path} succesfully uploaded!</pre>";
    }
}

?>

分析代码

//这个就是设置上传目录的
$target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
//basename()函数返回路径中的文件名。
//$_FILES[ 'uploaded' ][ 'name' ]获取上传文件的文件名
//.= 是把上面的target_path变量的值和下面的target_path变量的值拼接。路径+上传的文件名
$target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

move_uploaded_file() 函数将上传的文件移动到新位置语法move_uploaded_file(file,newloc)file必须设置,规定要移动的文件,newloc必需设置,规定文件的新位置。

//获取上传的文件移动到target_path变量设置的目录 如果值为false就上传失败
if( !move_uploaded_file( $_FILES[ 'uploaded' ][ 'tmp_name' ], $target_path ) ) {
   

low等级代码没有过滤直接上传PHP文件就行了。

Medium等级代码

<?php

if( isset( $_POST[ 'Upload' ] ) ) {
   
    // Where are we going to be writing to?
    $target_path  = DVWA_WEB_PAGE_TO_ROOT . "hackable/uploads/";
    $target_path .= basename( $_FILES[ 'uploaded' ][ 'name' ] );

    // File information
    $uploaded_name = $_FILES[ 'uploaded' ][ 'name' ];
    $uploaded_type = $_FILES[ 'uploaded' ][ 'type' ];