WooYun.org

$ToRemove = post('ToRemove');//接收post参数ToRemove
$size     = @filesize($ToRemove);
if(is_array($_SESSION['tmpName']))
{
    $key = array_search($ToRemove,$_SESSION['tmpName']);
}else
{
    $key = null;
}
if(file_exists($ToRemove))
{
    $res = @unlink($ToRemove);//没有经过任何过滤便进入了危险函数unlink，造成任意文件删除
    if($res == 1)
    {   //文件被del了
        if($size != false)
        {
            $_SESSION['size'] -= $size;
            if($_SESSION['size'] < 0 )
            {
                $_SESSION['size'] = 0;
            }
        }
        unset($_SESSION['upload'][$key],$_SESSION['tmpName'][$key]);
    }
}