WooYun.org

/**
     * 下载一个文件
     *
     */
    // 此处存在任意文件下载漏洞--fuck
    public function download(){
        global $file;
        $this->model->download_file($file);
    }

/**
     * 下载一个文件
     *
     * @param unknown_type $file            
     */
    public function download_file($file) {
        if (file_exists ( $file )) {
            $this_base_file = basename ( $file );
            header ( "Content-type:application/octet-stream" );
            header ( "Accept-Ranges: bytes" );
            header ( "Accept-Length: " . filesize ( $file ) );
            header ( "Content-Disposition: attachment; filename=\"" . $this_base_file . "\"" );
            readfile ( $file );
        }
    }