Description
finecms 5.0.8 的Api.php的$file变量可控，进而$result也是可控的，从而$new_file也是可控的，可以构造为php文件，从而造成任意文件上传漏洞
finecms 5.0.8 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.ddpoc.com/DVB-2022-3669.html
https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/Finecms/Finecms%205.0.8%20%E4%BC%9A%E5%91%98%E4%B8%AD%E5%BF%83%E4%BB%BB%E6%84%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/
https://baizesec.github.io/bylibrary/%E6%BC%8F%E6%B4%9E%E5%BA%93/01-CMS%E6%BC%8F%E6%B4%9E/FineCMS/FineCMS_v5.0.8%E4%B8%A4%E5%A4%84getshell/
https://vip.bdziyi.com/5589/
https://www.cnvd.org.cn/flaw/show/CNVD-2017-12451
https://blog.csdn.net/Miracle_ze/article/details/126347577
https://www.cnblogs.com/ichunqiu/p/7453208.html
https://juejin.cn/post/7028872018808274951