.用友ICC网站客服系统远程代码执行漏洞EXP

admin

<?php
( @% k- u2 W; c7 {' {/**
/ C1 S; R8 j7 r3 L1 N. T * uploadFlash.php
0 K9 O1 G- {* k( K5 z+ `, E9 R * Flash文件上传.
  l! R1 R' j9 F1 e% c */
require_once('../global.inc.php');
; \- v+ Z. b8 i  e: L, r) ~+ }
//operateId=1 上传,operateId=2 获取地址.
  [8 q  z' _& o# j. \$operateId = intval($_REQUEST['operateId']);
+ @( S. u3 s* h( W- T+ Wif(empty($operateId)) exit;

3 x3 O( ]8 n2 g& {( l9 }if($operateId == 1){
4 z6 i' q1 J1 L( \ $date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
- I  ~( T9 b) F/ @ //if (!is_dir($dest)) mkdir($dest, 0777);
% S; c# E! C5 k( ^$ x( f5 E" }6 r
$nameExt = strtolower($COMMON->getFileExtName($_FILES['Filedata']['name']));

" }. \% ]0 \# H) f  N! a $allowedType = array('jpg', 'gif', 'bmp', 'png', 'jpeg');
: @2 {, C3 R$ Q+ n) F3 g
+ t( f8 z  W4 w. o' U3 e" B9 h; Z if(!in_array($nameExt, $allowedType)){
- ~5 L+ f; j& J$ `7 M  $msg = 0;
$ i: T# U- `$ A }
/ Y% s$ W2 C: G- w0 x5 ` if(empty($msg)){
  $filename = getmicrotime().'.'.$nameExt;
  $file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
- o2 r9 V2 l# N8 y  
9 ]/ h) N7 c1 D1 g  $filename = $dest.$filename;
9 @1 `0 a/ |3 l1 v- d  if(empty($_FILES['Filedata']['error'])){
2 {0 |  }/ f& |: ~# k   move_uploaded_file($_FILES['Filedata']['tmp_name'],$filename);
  }
, p5 K9 a& q& t  `9 h' k  
1 r: K1 z) n. s( G0 b  if (file_exists($filename)){
4 q- X9 b. K: \   //$msg = 1;
   $msg = $file_url;
" w) [4 s# R& g/ K/ O) r7 o; z   @chmod($filename, 0444);
6 N$ e. [% }# H) b: W) ^% n  }else{
" B4 M' h  {( U) [- U   $msg = 0;
  }
% y8 x3 L" \/ I }
/ _' ^+ U  W! ~/ M) g $outMsg = "fileUrl=".$msg;
$_SESSION["eoutmsg"] = $outMsg;
exit;
( U1 E! y7 j+ z9 o" ^& |}else if($operateId == 2){
$outMsg = $_SESSION["eoutmsg"];
$ r3 u  d! |) ], f" Z if(!empty($outMsg)){
+ ~+ t0 C3 c  q$ E: f& q  session_unregister("eoutmsg");
% Z0 w( m; I  Z7 ~; |1 _  echo '&'.$outMsg;
  exit;
}else{
  echo "&fileUrl=0";
  exit;
}
7 i8 X, Y1 r1 f5 T+ N  S5 E4 W}

+ [6 ^% f( z* ^( V8 l5 Wfunction getmicrotime(){
+ i5 I! ^; I' q& r+ E  ?( }    list($usec, $sec) = explode(" ",microtime());
. F( c6 O  }0 A    return ((float)$usec + (float)$sec);
}
$ X$ M. _0 o+ S3 }3 d% C7 i6 U
: E* R$ a. R+ D' _% ^1 g! Q) `$ R?>