profile.php arbitrary file upload vulnerability

[byck01]

• 1.Profile.php does not evaluate the suffix at the upload file, causing any file upload vulnerability

• test.php

<?php
phpinfo();
?>

• Upload test.php at user management; successfully execute code http://localhost/CMSsite-master/img/test.php

[VictorAlagwu]

Thanks for the review, kindly send a corresponding fix or PR to this issue.

[byck01]

You should judge the uploaded file suffix before the move_uploaded_file function.