.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
2 q0 X( e# j0 ^# t, y+ f! V# F+ A: K * uploadFlash.php
- X; E! N. P7 I& z, w, t, F2 }! d * Flash文件上传.
% k% e4 q# r& y( {$ S- @  r */
require_once('../global.inc.php');

# m; U4 l! Z" Q: x, u+ v) X//operateId=1 上传,operateId=2 获取地址.
$operateId = intval($_REQUEST['operateId']);
! u- r4 D5 Z8 Jif(empty($operateId)) exit;
$ k, C( j5 J4 Q3 c
if($operateId == 1){
6 y) T! {0 e2 L& f3 U $date = date("Ymd");
: |5 j# E+ b, Z- B/ b( A4 T/ a; D0 d $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
* J( [5 a0 i# X  c0 s$ P6 W* H //if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

$allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
5 M; n. e5 t3 s; l
if(!in_array($nameExt, $allowedType)){
* ], M- h' F; t' x1 }5 q! g  $msg = 0;
}
. _3 r8 e/ r7 ^7 O  @% p1 r) F if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
+ V' n1 s9 Y1 P) I  $filename = $dest.$filename;
  if(empty($_FILES['Filedata']['error'])){
   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
5 r  Y2 D! X9 D9 O  }
* z& F0 v, c0 M7 r  
  if (file_exists($filename)){
   //$msg = 1;
   $msg = $file_url;
- S! j4 m; U3 R8 T7 H   @chmod($filename, 0444);
* E5 i! ^0 H' E0 K) W  }else{
: ]. }4 a1 l' y. k& n: ?6 q; K   $msg = 0;
* U  Q( R" a+ k! v9 n% Q. m4 i  }
/ x; [! F, `: `2 s" z }
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
3 G6 Y" x# R) k9 M, a6 b. W. F exit;
}else if($operateId == 2){
% o9 o8 i) J! p( m& G2 A: @1 K $outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
# b$ G- G% D9 c7 E! A  session_unregister("eoutmsg");
8 T+ V7 s) ]1 y9 [; w6 R0 C3 c$ @  echo '&'.$outMsg;
  exit;
}else{
0 F; k& f( m+ f. G+ f0 S$ T; [  echo "&fileUrl=0";
  exit;
# f: [$ t+ p" v2 a9 h5 G. t }
}

6 X( U9 E, [) E: e+ bfunction getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
    return ((float)$usec + (float)$sec);
}

# a7 J0 g- j: z6 }?>