• 文件扩展名检测漏洞(ps:文件扩展名可以被任意伪造)
• 文件MIME类型判断不能使用$_FILES['userfile']['type'](ps:根据PHP官方的文档说明，该值完全可以被伪造！黑客只需修改浏览器的post请求头即可绕过这段代码检查，进而上传任意类型的文件！)

• 通过文件扩展名判断是03的excel文件还是07的excel文件
• 根据不同的文件，获取不同文件的二进制数据，和file_signature进行对比，我截了03和07的excel的二进制数据图，大家可以参考一下，工具是madedit
• 03的excel
• 
  
• 07的excel(07可以参考zip检测)
• 
  

	/**
	 * Detect upload file type
	 * 
	 * @param array $file        	
	 * @return bool $flag
	 */
	private function detectUploadFileMIME($file) {
		// 1.through the file extension judgement 03 or 07
		$flag = 0;
		$file_array = explode ( ".", $file ["name"] );
		$file_extension = strtolower ( array_pop ( $file_array ) );
		
		// 2.through the binary content to detect the file
		switch ($file_extension) {
			case "xls" :
				// 2003 excel
				$fh = fopen ( $file ["tmp_name"], "rb" );
				$bin = fread ( $fh, 8 );
				fclose ( $fh );
				$strinfo = @unpack ( "C8chars", $bin );
				$typecode = "";
				foreach ( $strinfo as $num ) {
					$typecode .= dechex ( $num );
				}
				if ($typecode == "d0cf11e0a1b11ae1") {
					$flag = 1;
				}
				break;
			case "xlsx" :
				// 2007 excel
				$fh = fopen ( $file ["tmp_name"], "rb" );
				$bin = fread ( $fh, 4 );
				fclose ( $fh );
				$strinfo = @unpack ( "C4chars", $bin );
				$typecode = "";
				foreach ( $strinfo as $num ) {
					$typecode .= dechex ( $num );
				}
				echo $typecode;
				if ($typecode == "504b34") {
					$flag = 1;
				}
				break;
		}
		
		// 3.return the flag
		return $flag;
	}

参考链接