.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
/**
1 L! a! ?$ g: Q" K7 }3 H7 C * uploadFlash.php
* Flash文件上传.
*/
- Z$ S& `+ G: {5 W% f4 W% p; ]0 Arequire_once('../global.inc.php');

//operateId=1 上传,operateId=2 获取地址.
/ Y9 f! b* c! u0 |$operateId = intval($_REQUEST['operateId']);
if(empty($operateId)) exit;

if($operateId == 1){
! b$ ^8 s$ y3 H3 k7 x7 k $date = date("Ymd");
2 R0 g% ~! F+ c $dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest)) mkdir($dest, 0777);

$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));
$ c5 \; @) A6 i8 ?
2 P& L# Y! O' N7 t $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
* d" |/ u  t0 Y4 i5 P2 d
& d# A2 h( |! i; } if(!in_array($nameExt, $allowedType)){
9 }) H! B7 F) ^9 j  $msg = 0;
}
  h: V2 P: K. r/ y; F3 f$ H, O# i8 Y. q2 v if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
+ |7 E! c+ o$ I4 j% O' j  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
  
3 \# d: W) n- T' s; y  $filename = $dest.$filename;
; ?$ F" h; L. y# \5 ^1 G  if(empty($_FILES['Filedata']['error'])){
$ }8 [$ h5 W( o# W7 A8 }   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
/ q4 U& p6 F$ z3 M' r) [. b& J  
  if (file_exists($filename)){
3 f+ q- O* C9 q/ R1 T% h   //$msg = 1;
& E6 {) t! I+ z: O# n, ]( x   $msg = $file_url;
   @chmod($filename, 0444);
4 z" R( i# {% i! T# l) W! I, H) I  }else{
   $msg = 0;
/ y) I0 {8 h, K* u; f1 u  I& g  }
}
$outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
5 c# w! D7 R7 j8 E& `! S exit;
" s! v6 ]1 _2 o1 o8 G}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
if(!empty($outMsg)){
/ N; U% ~" U4 F- Y1 g, b& H. u  session_unregister("eoutmsg");
! i6 y, V, H9 g, Z  d8 X* s  echo '&'.$outMsg;
6 `7 T9 W( D8 }1 y/ w! j3 l, I  exit;
: d. u% _4 _, d; M2 X# w" o }else{
  echo "&fileUrl=0";
6 u5 a; w$ @: n8 ~  exit;
) y* J  ?1 Q  e }
}

function getmicrotime(){
    list($usec, $sec) = explode(" ",microtime());
& z% r+ w. [. r& p" k    return ((float)$usec + (float)$sec);
9 e: N7 z2 W% K5 l! n}

?>