記一道特別傻**的檔案上傳

一開始怎麼傳都不行，也沒有回顯，後來才知道這是一個假的”上傳“

f12，需要使用者自己改成submit

後面還限制了字尾名，雙寫即可繞過，getwebshell

貼一下原始碼

<?php
include 'config.php';

$is_upload = false;
$msg = null;
if (isset($_POST['submit'])) {
    if (file_exists(UPLOAD_PATH)) {
        $deny_ext = array("php","php5","php4","php3","php2","html","htm","phtml","pht","jsp","jspa","jspx","jsw","jsv","jspf","jtml","asp","aspx","asa","asax","ascx","ashx","asmx","cer","swf","htaccess","ini");

        $file_name = trim($_FILES['upload_file']['name']);
        $file_name = str_ireplace($deny_ext,"", $file_name);
        $temp_file = $_FILES['upload_file']['tmp_name'];
        $img_path = UPLOAD_PATH.'/'.$file_name;        
        if (move_uploaded_file($temp_file, $img_path)) {
            $is_upload = true;
        } else {
            $msg = '上傳出錯！';
        }
    } else {
        $msg = UPLOAD_PATH . '發現你了hacker！！！';
    }
}
 
?>

<div id="upload_panel">
    <ol>
        <li>
            <form enctype="multipart/form-data" method="post">
                <input class="input_file" type="file" name="upload_file"/>
                <input class="button" type="submit" name="hidden" value="上傳"/>
 

            </form>
            <div id="msg">
                <?php 
                    if($msg != null){
                        echo "呵tui~~：".$msg;
                    }
                ?>
            </div>
            <div id="img">
                <?php
                    if($is_upload){
                        echo '<img src="'.$img_path.'" width="250px" />';
                    }
                
 
?>
            </div>
        </li>
        <?php 
            if($_GET['action'] == "show_code"){
                include 'show_code.php';
            }
        ?>
    </ol>
</div>

<?php
include '../footer.php';
?>