AppCMS pic.php XSS 漏洞

 1: <?php
 2: if(isset($_GET['url']) && trim($_GET['url']) != '' && isset($_GET['type'])) {
 3:     $img_url=trim($_GET['url']);
 4:     $img_url = base64_decode($img_url);
 5:     $img_url=strtolower(trim($img_url));
 6:     $_GET['type']=strtolower(trim($_GET['type']));
 7: 
 8:     $urls=explode('.',$img_url);
 9:     if(count($urls)<=1) die('image type forbidden 0');
10:     $file_type=$urls[count($urls)-1];
11: 
12:     if(in_array($file_type,array('jpg','gif','png','jpeg'))){}else{ die('image type foridden 1');}
13: 
14:     if(strstr($img_url,'php')) die('image type forbidden 2');
15: 
16:     if(strstr($img_url,chr(0)))die('image type forbidden 3');
17:     if(strlen($img_url)>256)die('url too length forbidden 4');
18: 
19:     header("Content-Type: image/{$_GET['type']}");
20:     readfile($img_url);
21: 
22: } else {
23:     die('image not find！');
24: }
25: ?>