天天团购系统0DAY - PHP团购程序漏洞

ajax.php：

require_once MOD_PATH.$this->SetEvent($config['default_module']).'.mod.php';
//再看SetEvent 
function SetEvent()
        {
                $modss = array('check'=>1,'getseller'=>1,'member'=>1);       
                $mod = (isset($_POST['mod']) ? $_POST['mod'] : $_GET['mod']);
                if(!isset($modss)) {  //程序员思想混乱了.估计老板没发工资
                        include(INCLUDE_PATH.'error_404.php');
                        exit;
                }
                $_POST['mod'] = $_GET['mod'] = $mod;                       
                Return $mod;
        }

modules\admin\tttuangou.mod.php：

class ModuleObject extends MasterObject{
        var $city;
        function ModuleObject($config){
                $this->MasterObject($config);                Load::logic('product');
                $this->ProductLogic = new ProductLogic();
                Load::logic('pay');
                $this->PayLogic = new PayLogic();
                Load::logic('me');
                $this->MeLogic = new MeLogic();
                Load::logic('order');
                $this->OrderLogic = new OrderLogic();
                $this -> config =$config;
                $this->ID = (int) ($this->Post['id'] ? $this->Post['id'] : $this->Get['id']);
                $this->Execute();
        }
        //很幸运地以上自定义函数都已经定义了
function Execute(){
        switch($this->Code){
                case 'varshow':
                        $this->Varshow();
                        break;
                case 'varedit':
//忽略一堆东西
case 'dositelogo':
        $this->doSiteLogoManager();
//再看doSiteLogoManager
function doSiteLogoManager()
        {
                //这里忽略一些没用的东西
                        $_FILES['uploads']['name'] = $FILES_O['uploads']['name'][$i];
        //继续忽略
                        $default_type=array('jpg','pic','png','jpeg','bmp','gif');                         $imgary=explode('.',$_FILES['uploads']['name']);
                        if(!in_array(strtolower($imgary[count($imgary)-1]),$default_type)){
                                $this->Messager('不允许上传的图片格式！');
                        }
//这里限制了后缀
                        $full_path = urldecode($this->Get['path']);
                        $fp_ary = explode('/', $full_path);
                        $file = $fp_ary[count($fp_ary)-1];
                        $dir = '';
                        for ($i=0;$i<count($fp_ary)-1;$i++)
                        {
                                if ($fp_ary[$i] != '.')
                                {
                                        $dir .= $fp_ary[$i].'/';
                                }
                        }   
                        $dir = './'.$dir;  //o(∩_∩)o 哈哈  悲剧 path自定义名字可以了 直接上传JPG
                        require_once LIB_PATH . 'upload.han.php';
                        $upload_handler = new UploadHandler($_FILES, $dir, 'uploads' , true);

modules\me.mod.php：

function Readdmoney(){
        $pay_code = (isset($_POST['pay']) ? $_POST['pay'] : $_GET['pay']); //没过滤
//忽略...
        include_once('./modules/'.$pay_code.'.pay.php');

index.mod.php：

function Repay(){
        $pay_code = (isset($_POST['pay']) ? $_POST['pay'] : $_GET['pay']);  //一样没过滤
//也忽略...
        include_once('./modules/'.$pay_code.'.pay.php');