CVE-2025-0520 runtime summary
=============================
Vulnerable v2.8.2:
- Real endpoint POST /index.php?s=/home/page/uploadImg accepted filename test.<>php
- Controller path includes: $upload->allowExts and $info = $upload->upload()
- Uploaded PHP path recorded in runtime_artifacts/http/vuln/uploaded_php_files.txt
- Executing uploaded file returned marker: RCE_OK_1e08f13e8e4695e97fef6d9de3665be4

Fixed fb77dd4:
- Same request blocked with message: 上传文件后缀不允许
- Controller updated to $upload->exts
- No uploaded PHP file present under Public/Uploads

Fixed e1cd02a:
- uploadImg() disabled via early return false
- Same request returns empty body (Content-Length: 0)
- No uploaded PHP file present under Public/Uploads