Weaving dream dedecms background file media_add.php arbitrary upload vulnerability solution

After Zhimeng is installed on the Alibaba Cloud server, the Alibaba Cloud background will prompt the media_add.php background file to upload the vulnerability arbitrarily. The resulting file is the media_add.php file in the background management directory. Let me share with you the repair method for this vulnerability:

 

First find and open the media_add.php file in the background management directory, and find the following code in it:

 

1 $fullfilename = $cfg_basedir.$filename;

Add the following code above it:        

 

1 if (preg_match('#\.(php|pl|cgi|asp|aspx|jsp|php5|php4|php3|shtm|shtml)[^a-zA-Z0-9]+$#i', trim($filename))){ 2                 ShowMsg("你指定的文件名被系统禁止！",'java script:;'); 3                 exit(); 4             }

 

 

 

After adding, save and replace the original file.