WooYun.org

'connectionString' => 'mysql:host=localhost;dbname=ccihr',
            'emulatePrepare' => true,
            'username' => 'ccihr',
            'password' => 'Uc7fehxc3',
            'charset' => 'utf8',

$fileTypes  = str_replace('*.','',$_REQUEST['fileExt']); //文件扩展名竟然来自前台
$fileTypes  = str_replace(';','|',$fileTypes);
$typesArray = split('\|',$fileTypes);
$fileParts  = pathinfo($_FILES['Filedata']['name']);
if (in_array($fileParts['extension'],$typesArray)) {
    if (!empty($_FILES)) {
        $tempFile = $_FILES['Filedata']['tmp_name'];
        $targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/';
        $targetFile =  str_replace('//','/',$targetPath) . $_FILES['Filedata']['name'];
        move_uploaded_file($tempFile,$targetFile);
        echo str_replace($_SERVER['DOCUMENT_ROOT'],'',$targetFile);