漏洞概述 该网页截图显示了一个WordPress插件目录中的文件 ，该文件位于 目录下。文件中存在一个潜在的安全问题，具体表现为对文件上传类型的过滤不够严格，可能导致恶意文件上传。 影响范围 插件名称：Swiss Toolkit for WP 版本：1.4.2 受影响文件： 影响功能：文件上传功能 修复方案 1. 加强文件类型过滤：在 和 函数中，确保对上传文件的类型进行更严格的验证。 2. 使用白名单机制：仅允许已知的安全文件类型上传，避免使用黑名单机制。 3. 增加文件内容检查：除了检查文件扩展名，还应检查文件内容，确保其符合预期的格式。 4. 更新插件：建议用户及时更新插件到最新版本，以获取最新的安全补丁。 POC代码 以下是截图中相关的代码片段，展示了文件上传类型过滤的逻辑： ```php public function upload_extension_file($types, $file, $filename, $mimes) { $settings = BDSTW_Swiss_Toolkit_Settings::get_settings(); $supports = $settings['boomerswiss_extension_supports_textarea']; $extensions_array = explode(',', $supports); $mime_types = [ 'jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'webp' => 'image/webp', 'avif' => 'image/avif', 'png' => 'image/png', 'gif' => 'image/gif', 'bmp' => 'image/bmp', 'tiff' => 'image/tiff', 'ico' => 'image/x-icon', 'svg' => 'image/svg+xml', 'mp4' => 'video/mp4', 'webm' => 'video/webm', 'ogg' => 'video/ogg', 'mov' => 'video/quicktime', 'avi' => 'video/x-msvideo', 'wmv' => 'video/x-ms-wmv', 'flv' => 'video/x-flv', 'pdf' => 'application/pdf', 'doc' => 'application/msword', 'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'xls' => 'application/vnd.ms-excel', 'xlsx' => 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'ppt' => 'application/vnd.ms-powerpoint', 'pptx' => 'application/vnd.openxmlformats-officedocument.presentationml.presentation', 'txt' => 'text/plain', 'csv' => 'text/csv', 'rtf' => 'application/rtf', 'zip' => 'application/zip', 'rar' => 'application/x-rar-compressed', '7z' => 'application/x-7z-compressed', 'gz' => 'application/gzip', 'tar' => 'application/x-tar', 'bz2' => 'application/x-bzip2', 'xz' => 'application/x-xz', 'mp3' => 'audio/mpeg', 'wav' => 'audio/wav', 'flac' => 'audio/flac', 'aac' => 'audio/aac', 'ogg' => 'audio/ogg', 'wma' => 'audio/x-ms-wma', 'm4a' => 'audio/x-m4a', 'opus' => 'audio/opus', 'weba' => 'audio/webm', 'mid' => 'audio/midi', 'midi' => 'audio/midi', 'kar' => 'audio/midi', 'rmi' => 'audio/midi', 'smf' => 'audio/midi', 'sf2' => 'audio/sf2', 'vqf' => 'audio/vqf', 'aif' => 'audio/x-aiff', 'aiff' => 'audio/x-aiff', 'aifc' => 'audio/x-aiff', 'ra' => 'audio/x-pn-realaudio', 'ram' => 'audio/x-pn-realaudio', 'rm' => 'audio/x-pn-realaudio', 'rpm' => 'audio/x-pn-realaudio-plugin', 'sd2' => 'audio/x-sd2', 'snd' => 'audio/x-snd', 'svx' => 'audio/x-svx', 'au' => 'audio/basic', 'snd' => 'audio/basic', 'vox' => 'audio/voxware', 'w64' => 'audio/x-w64', 'm3u' => 'audio/x-mpegurl', 'pls' => 'audio/x-scpls', 'm3u8' => 'audio/x-mpegurl', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4r' => 'audio/x-m4r', 'm4v' => 'video/x-m4v', 'm4a' => 'audio/x-m4a', 'm4b' => 'audio/x-m4b', 'm4p' => 'audio/x-m4p', 'm4