WooYun.org

keke_user_avatar_class.php文件：
	static function uploadavatar($uid) {
		@header ( "Expires: 0" );
		@header ( "Cache-Control: private, post-check=0, pre-check=0, max-age=0", FALSE );
		@header ( "Pragma: no-cache" );
		if (empty ( $uid )) {
			return - 1;
		}
		if (empty ( $_FILES ['Filedata'] )) {
			return - 3;
		}
		list ( $width, $height, $type, $attr ) = getimagesize ( $_FILES ['Filedata'] ['tmp_name'] );
		$imgtype = array (1 => '.gif', 2 => '.jpg', 3 => '.png' );
		$filetype = $imgtype [$type];
		if (! $filetype)
			$filetype = '.jpg';
		$tmpavatar = _DATADIR . './tmp/upload' . $uid . $filetype;
		file_exists ( $tmpavatar ) && @unlink ( $tmpavatar );
		if (@copy ( $_FILES ['Filedata'] ['tmp_name'], $tmpavatar ) || @move_uploaded_file ( $_FILES ['Filedata'] ['tmp_name'], $tmpavatar )) {
			@unlink ( $_FILES ['Filedata'] ['tmp_name'] );
			list ( $width, $height, $type, $attr ) = getimagesize ( $tmpavatar );
			if ($width < 10 || $height < 10 || $type == 4) {
				@unlink ( $tmpavatar );
				return - 2;
			}
		} else {
			@unlink ( $_FILES ['Filedata'] ['tmp_name'] );
			return - 4;
		}
		$avatarurl = _DATAURL . '/tmp/upload' . $uid . $filetype;
		return $avatarurl;
	}
在这里$tmpavatar = _DATADIR . './tmp/upload' . $uid . $filetype; 是保存的文件名，在这里uid没有进行过滤，也没有进行长度限制，由于开了GPC 无法利用%00截断。这里就用长文件名截断